Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:Setup.exe
Analysis ID:1548201
MD5:f25415e055d48e6d0ab0c4b6c3165571
SHA1:daaebabd9d60f9b33971510e04cf94d53054869a
SHA256:79e9cfa54607c341197d5221ee016d6b1676988f5b50ce10ce04c2695eafcb3c
Infos:

Detection

Score:51
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:34
Range:0 - 100

Signatures

Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
EXE planting / hijacking vulnerabilities found
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a global mouse hook
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Setup.exe (PID: 5348 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: F25415E055D48E6D0AB0C4B6C3165571)
    • chrome.exe (PID: 396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241104010727.305&_fcid=1730700255692837 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5236 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • nsa4E4E.tmp (PID: 5928 cmdline: "C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force MD5: 84EE733F8014D22DAD2DFEF725489980)
      • PcAppStore.exe (PID: 5324 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)
        • explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
          • PcAppStore.exe (PID: 1820 cmdline: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 4908 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 5088 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 3872 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 3668 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 1544 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 4548 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 1620 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 2484 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 4924 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 5608 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 3152 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 1732 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 5312 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 2084 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 4624 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 5432 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 4144 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 5740 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 5984 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 1136 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 3244 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 2924 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 2692 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 3664 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 5416 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 3452 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 4228 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 736 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • CdHffnRZmAeqywugPqpABCcYuGUADn.exe (PID: 3740 cmdline: "C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • Watchdog.exe (PID: 5756 cmdline: "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241104010824.6836367156 /ver=fa.1092c MD5: 11F3801CB9FF046D6075F681971C4EB8)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp, ProcessId: 5928, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpReversingLabs: Detection: 41%
Source: C:\Users\user\PCAppStore\Uninstaller.exeReversingLabs: Detection: 29%
Machine Learning detection for sample
Source: Setup.exeJoe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to behavior
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730700255692837&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730700255692837&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730700255692837&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730700255692837&_winver=19045&version=fa.1092cHTTP Parser: No favicon

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to behavior
Uses 32bit PE files
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Creates a software uninstall entry
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStoreJump to behavior
Creates license or readme file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txtJump to behavior
PE / OLE file has a valid certificate
Source: Setup.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsa4E4E.tmp, 00000009.00000002.2423520385.00000000027CC000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000000.2303366152.00007FF6E981A000.00000002.00000001.01000000.00000017.sdmp, Watchdog.exe, 0000000B.00000002.2929649453.00007FF6E981A000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002EB7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000000E.00000002.2908026871.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000010.00000000.2371350987.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000011.00000000.2373958479.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000012.00000000.2377787528.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000013.00000002.2908042981.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000014.00000002.2908028011.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000015.00000002.2908006805.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000016.00000002.2916220655.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000018.00000002.2912021981.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000019.00000002.2908039532.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001A.00000002.2908033293.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001B.00000000.2414237920.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001C.00000000.2416329357.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001D.00000002.2908382870.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001E.00000002.2908696093.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001F.00000000.2422609116.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000020.00000002.2908553464.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000021.00000002.2908037750.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000022.00000002.2908002299.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000023.00000002.2908040521.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000024.00000002.2908034532.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000025.00000002.2916650078.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000026.00000002.2908036782.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000027.00000000.24347701
Source: Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\engine\Release\PCAppStore.pdb source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2302747427.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2402968519.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395883794.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002EB7000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406873 FindFirstFileW,FindClose,0_2_00406873
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040290B FindFirstFileW,0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpCode function: 9_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,9_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpCode function: 9_2_0040699E FindFirstFileW,FindClose,9_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpCode function: 9_2_0040290B FindFirstFileW,9_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2875F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,10_2_00007FF7BC2875F8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2876A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,10_2_00007FF7BC2876A8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E98016E0 FindClose,FindFirstFileExW,GetLastError,11_2_00007FF6E98016E0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9810330 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,11_2_00007FF6E9810330
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9801754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,11_2_00007FF6E9801754
Source: Joe Sandbox ViewIP Address: 159.223.126.41 159.223.126.41
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewIP Address: 167.99.235.203 167.99.235.203
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC11CB80 GetTickCount64,Sleep,GetTickCount,Sleep,URLDownloadToFileW,Sleep,DeleteFileW,10_2_00007FF7BC11CB80
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3281992365.00002E44005BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3276745313.00002E44002C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2162R
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282072996.00002E44005E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000002.3292709635.00002E4400F08000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000002.3292709635.00002E4400F08000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000002.3292709635.00002E4400F08000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4937x
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282072996.00002E44005E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000002.3284883380.00002E44007DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5881w
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000002.3284883380.00002E44007DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8215x
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282072996.00002E44005E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000001.00000002.3280355587.00002E4400514000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAt
Source: chrome.exe, 00000001.00000002.3279757116.00002E440049C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pa
Source: chrome.exe, 00000001.00000002.3300849110.00002E44015BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3300849110.00002E44015BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx352.0/.D
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemjh
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihi
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagna
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckhobagln
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkkcocm
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpng
Source: chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obed
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanleaf
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjd
Source: chrome.exe, 00000001.00000002.3294306682.00002E4401024000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkjcecd
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcji
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnf
Source: chrome.exe, 00000001.00000002.3302550833.00002E44018E8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: chrome.exe, 00000001.00000002.3302550833.00002E44018E8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dns-tunnel-check.googlezip.net/connect.D
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00
Source: chrome.exe, 00000001.00000002.3293373391.00002E4400F90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebnd
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookg
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acisphmku46ptpbe4irtwh7guyza_9269/hfnkpim
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclacns2lwpknygjwzhz5vqbtzhq_1118/efniojl
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjk
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.23
Source: chrome.exe, 00000001.00000002.3273972426.00002E440014C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.69042
Source: chrome.exe, 00000001.00000002.3280355587.00002E4400514000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/k
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: chrome.exe, 00000001.00000002.3288206158.00002E4400A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbog
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.120
Source: chrome.exe, 00000001.00000002.3267856682.00002E440008D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000002.3149005354.0000022A06F77000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://localhost:64111/browseore/api/api.php8899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%
Source: Setup.exe, 00000000.00000003.1716247366.0000000002BD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1697332689.0000000002BD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://microsoft.co
Source: Setup.exe, 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Setup.exe, 00000000.00000000.1648600171.000000000040A000.00000008.00000001.01000000.00000003.sdmp, nsa4E4E.tmp, 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002F48000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000000.1943082913.000000000040A000.00000008.00000001.01000000.0000000F.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS0
Source: chrome.exe, 00000001.00000002.3293373391.00002E4400F90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000001.00000002.3286566361.00002E4400960000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000001.00000002.3286566361.00002E4400960000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalid/a
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgy
Source: chrome.exe, 00000001.00000002.3279757116.00002E440049C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thir
Source: chrome.exe, 00000001.00000002.3300849110.00002E44015BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnn
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompec
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckhob
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acisphmku46ptpbe4irtwh7guyza_9269/hfnkpimlhhgiead
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkk
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eei
Source: chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/
Source: chrome.exe, 00000001.00000002.3280355587.00002E4400514000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncan
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjd
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkj
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindgg
Source: chrome.exe, 00000001.00000002.3282528088.00002E4400644000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhl
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkeh
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3267856682.00002E4400064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000001.00000002.3267856682.00002E4400064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet.D
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3279426623.00002E44003A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000001.00000002.3274347534.00002E4400194000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000001.00000002.3274347534.00002E4400194000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000001.00000002.3267856682.00002E4400064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000001.00000002.3267856682.00002E4400064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB.D
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000001.00000002.3303264999.00002E440194C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3177907218.0000022A08FBD000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://analytics.google.com/g/collect?v=2&tid=G-VFQWFX3X1C&gtm=45je4au0v898645365za200zb9103256652&
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3279426623.00002E44003A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282072996.00002E44005E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7382-
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7847ID.
Source: chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000001.00000002.3288206158.00002E4400A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000001.00000002.3288206158.00002E4400A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000001.00000002.3288206158.00002E4400A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282072996.00002E44005E0000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.2986765549.0000017F0FCD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000002.3286566361.00002E4400960000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3288883849.00002E4400B70000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000001.00000002.3288883849.00002E4400B70000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en106243
Source: chrome.exe, 00000001.00000002.3288883849.00002E4400B70000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=end
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3310754888.00004B1800794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3310754888.00004B1800794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3310754888.00004B1800794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000001.00000002.3310754888.00004B1800794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(TrustTokenOperationsRequiringOriginTrial#all-operat
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000001.00000002.3300376420.00002E4401504000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000001.00000002.3300376420.00002E4401504000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/7
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3281925710.00002E44005A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282282304.00002E4400618000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000001.00000002.3282282304.00002E4400618000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx.Da
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000001.00000002.3280355587.00002E4400514000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000001.00000002.3276909640.00002E44002E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.c
Source: chrome.exe, 00000001.00000002.3295538109.00002E44010DD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3306230793.00002E4401BEC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3300376420.00002E4401504000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287635345.00002E4400A28000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302111748.00002E4401888000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-serving
Source: chrome.exe, 00000001.00000002.3302111748.00002E4401888000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-serving.D
Source: chrome.exe, 00000001.00000002.3305395954.00002E4401B58000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-serving6
Source: chrome.exe, 00000001.00000002.3287635345.00002E4400A28000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-servingCross-Origin-Resource-Policy:
Source: chrome.exe, 00000001.00000002.3294418213.00002E4401054000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290405446.00002E4400C90000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3306854362.00002E4401DA8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3158173267.0000022A0702D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000001.00000002.3290405446.00002E4400C90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:
Source: chrome.exe, 00000001.00000002.3282771314.00002E4400664000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284073724.00002E4400744000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1
Source: chrome.exe, 00000001.00000002.3274177851.00002E440017C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1.D
Source: chrome.exe, 00000001.00000002.3274177851.00002E440017C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/12F%2Fpcapp.store
Source: chrome.exe, 00000001.00000002.3276909640.00002E44002E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282771314.00002E4400664000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284073724.00002E4400744000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Security-Policy:
Source: chrome.exe, 00000001.00000002.3276909640.00002E44002E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282771314.00002E4400664000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284073724.00002E4400744000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Type:
Source: chrome.exe, 00000001.00000002.3282771314.00002E4400664000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284073724.00002E4400744000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1d
Source: chrome.exe, 00000001.00000002.3274177851.00002E440017C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1sers
Source: chrome.exe, 00000001.00000002.3287635345.00002E4400A28000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving
Source: chrome.exe, 00000001.00000002.3308227519.00002E440218C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0
Source: chrome.exe, 00000001.00000002.3307372583.00002E4401E0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
Source: chrome.exe, 00000001.00000002.3283532479.00002E4400704000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
Source: chrome.exe, 00000001.00000002.3177907218.0000022A08FBD000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
Source: chrome.exe, 00000001.00000002.3307372583.00002E4401E0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0.D
Source: chrome.exe, 00000001.00000002.3308227519.00002E440218C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0Cross-Origin-Opener-Policy-Report-Only:
Source: Setup.exe, 00000000.00000002.1960683749.0000000002C2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/
Source: Setup.exe, 00000000.00000003.1958885351.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1959307385.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1960683749.0000000002C2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/X
Source: Setup.exe, 00000000.00000002.1959860535.0000000000795000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_insta
Source: Setup.exe, 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=ersion=fa.1092c&src=pc
Source: Setup.exe, 00000000.00000003.1958885351.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1959307385.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1960683749.0000000002C2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=ersion=fa.1092cH
Source: Setup.exe, 00000000.00000002.1960531364.0000000002BA2000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1960683749.0000000002C2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092c
Source: Setup.exe, 00000000.00000003.1958885351.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1959307385.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1960683749.0000000002C2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092c5.tmp
Source: Setup.exe, 00000000.00000003.1958885351.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1959307385.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1960683749.0000000002C2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/rome
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjA
Source: chrome.exe, 00000001.00000002.3279757116.00002E440049C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_p
Source: chrome.exe, 00000001.00000002.3300849110.00002E44015BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3300849110.00002E44015BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3.D
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkih
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagn
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckhobagl
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acisphmku46ptpbe4irtwh7guyza_9269/hfnkpimlhhgieaddgf
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkkcoc
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpn
Source: chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obe
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanlea
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkj
Source: chrome.exe, 00000001.00000002.3294306682.00002E4401024000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkjcec
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcj
Source: chrome.exe, 00000001.00000002.3282528088.00002E4400644000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaae
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbn
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000001.00000002.3276745313.00002E44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3284650245.00002E44007A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3284650245.00002E44007A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3284650245.00002E44007A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000001.00000002.3276745313.00002E44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000001.00000002.3276745313.00002E44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3298109892.00002E44012FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3298206409.00002E4401314000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302550833.00002E44018E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299992830.00002E44014A4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302930214.00002E4401920000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3300698022.00002E4401598000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3300074259.00002E44014AC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3303612723.00002E4401974000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3300775006.00002E44015A8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/d
Source: chrome.exe, 00000001.00000002.3298109892.00002E44012FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3298206409.00002E4401314000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302550833.00002E44018E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299992830.00002E44014A4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302930214.00002E4401920000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3300074259.00002E44014AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/ore/
Source: chrome.exe, 00000001.00000002.3302550833.00002E44018E8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/ore/T
Source: chrome.exe, 00000001.00000002.3303612723.00002E4401974000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/t/
Source: chrome.exe, 00000001.00000002.3300698022.00002E4401598000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/t/.
Source: chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/t/.D
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000001.00000002.3279233878.00002E4400380000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: chrome.exe, 00000001.00000002.3293373391.00002E4400F90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebn
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflook
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acisphmku46ptpbe4irtwh7guyza_9269/hfnkpi
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclacns2lwpknygjwzhz5vqbtzhq_1118/efnioj
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmj
Source: chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.2
Source: chrome.exe, 00000001.00000002.3273972426.00002E440014C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.6904
Source: chrome.exe, 00000001.00000002.3280355587.00002E4400514000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.130
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/
Source: chrome.exe, 00000001.00000002.3288206158.00002E4400A8C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/g
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/ne
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbo
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.12
Source: chrome.exe, 00000001.00000002.3158173267.0000022A07027000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css2?family=Inter:wght
Source: chrome.exe, 00000001.00000002.3296748629.00002E440118C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://fonts.gstatic.com
Source: chrome.exe, 00000001.00000002.3296748629.00002E440118C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3283230586.00002E44006CC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://fonts.gstatic.com/
Source: chrome.exe, 00000001.00000002.3306783273.00002E4401D98000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://goog.com
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3310754888.00004B1800794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3310754888.00004B1800794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3270115806.00002E44000A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000001.00000002.3292709635.00002E4400F08000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: chrome.exe, 00000001.00000002.3307073662.00002E4401DCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3295371176.00002E44010AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730700452881&cv=
Source: chrome.exe, 00000001.00000002.3307073662.00002E4401DCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3295371176.00002E44010AC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3177907218.0000022A08FBD000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3158173267.0000022A0702D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730700452912&cv=
Source: chrome.exe, 00000001.00000002.3307073662.00002E4401DCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3304264888.00002E4401AA4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730700453732&cv=
Source: chrome.exe, 00000001.00000002.3298706212.00002E4401388000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284883380.00002E44007DC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3300698022.00002E4401598000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299731726.00002E4401480000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3303612723.00002E4401974000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3298845273.00002E44013BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/=
Source: chrome.exe, 00000001.00000002.3300698022.00002E4401598000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/a
Source: chrome.exe, 00000001.00000002.3298706212.00002E4401388000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/cy
Source: chrome.exe, 00000001.00000002.3298706212.00002E4401388000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/ithm
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000002.3293487083.00002E4400FB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000002.3293487083.00002E4400FB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000002.3293487083.00002E4400FB0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000002.3284650245.00002E44007A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000001.00000002.3284650245.00002E44007A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000001.00000002.3309487109.00004B1800288000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000002.3309487109.00004B1800288000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard#exps-registration-success-page-urls
Source: chrome.exe, 00000001.00000002.3309487109.00004B1800288000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboardK
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboardPi
Source: chrome.exe, 00000001.00000002.3310713411.00004B1800780000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000002.3310713411.00004B1800780000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3310754888.00004B1800794000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3310645942.00004B1800754000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000002.3132969891.0000022A067B0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload#companion-iph-blocklisted-page-urls
Source: chrome.exe, 00000001.00000002.3310754888.00004B1800794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000001.00000002.3310754888.00004B1800794000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000001.00000002.3277129636.00002E440030C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://m.google.com/devicemanagement/data/api.D
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272102411.00002E44000DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272102411.00002E44000DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272102411.00002E44000DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000001.00000002.3279233878.00002E4400380000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272102411.00002E44000DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000001.00000002.3274347534.00002E4400194000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000001.00000002.3288282854.00002E4400AB0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289284572.00002E4400BB4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290245158.00002E4400C78000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.3289284572.00002E4400BB4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290405446.00002E4400C90000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290245158.00002E4400C78000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290330625.00002E4400C84000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000002.3288282854.00002E4400AB0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289284572.00002E4400BB4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290245158.00002E4400C78000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000001.00000002.3276745313.00002E44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289284572.00002E4400BB4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290245158.00002E4400C78000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290330625.00002E4400C84000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000002.3276745313.00002E44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289284572.00002E4400BB4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290245158.00002E4400C78000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000001.00000002.3289284572.00002E4400BB4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290245158.00002E4400C78000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.3288282854.00002E4400AB0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289284572.00002E4400BB4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290330625.00002E4400C84000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000002.3288282854.00002E4400AB0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289284572.00002E4400BB4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290245158.00002E4400C78000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000002.3304005037.00002E4401A68000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3170135497.0000022A08F87000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=$
Source: chrome.exe, 00000001.00000002.3307664353.00002E4401E40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3276052785.00002E440027C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3296397148.00002E4401138000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.st
Source: chrome.exe, 00000001.00000002.3292498996.00002E4400EE9000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3274274008.00002E4400184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289183484.00002E4400BA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3307147605.00002E4401DDC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3291029383.00002E4400CE4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3279343928.00002E4400390000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287938694.00002E4400A7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3307734111.00002E4401E48000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store
Source: chrome.exe, 00000001.00000002.3291029383.00002E4400CE4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store.D
Source: chrome.exe, 00000001.00000002.3307073662.00002E4401DCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3283599478.00002E440071A000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3304264888.00002E4401AA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3276442437.00002E44002B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3306568940.00002E4401C4C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3297226362.00002E44011DA000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3177907218.0000022A08FB7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3295757568.00002E44010E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3205172270.0000022A09483000.00000002.00000001.00040000.0000001D.sdmp, chrome.exe, 00000001.00000002.3286297202.00002E440091C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3298626953.00002E4401374000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3274274008.00002E4400184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302550833.00002E44018E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3291132244.00002E4400CF4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3281859803.00002E4400588000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3041396832.00000035A8DFC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3297226362.00002E44011D5000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289459194.00002E4400BD4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3303775921.00002E4401A29000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3294418213.00002E4401040000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289838570.00002E4400C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/.D
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/.Dh
Source: chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/.DvFwww.
Source: chrome.exe, 00000001.00000002.3307073662.00002E4401DCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3205172270.0000022A09483000.00000002.00000001.00040000.0000001D.sdmp, chrome.exe, 00000001.00000002.3297226362.00002E44011D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store//
Source: chrome.exe, 00000001.00000002.3307073662.00002E4401DCC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/3357
Source: chrome.exe, 00000001.00000002.3308589677.00002E440234C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_instal
Source: chrome.exe, 00000001.00000002.3149005354.0000022A06F7D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3307734111.00002E4401E48000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290484127.00002E4400C9C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3270115806.00002E44000A4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287816760.00002E4400A5C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272102411.00002E44000DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=17307002556
Source: chrome.exe, 00000001.00000002.3308589677.00002E440234C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_instalng
Source: chrome.exe, 00000001.00000002.3304264888.00002E4401AA4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/P
Source: chrome.exe, 00000001.00000002.3177907218.0000022A08FB7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3280263026.00002E44004F0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3270185711.00002E44000C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284776588.00002E44007B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3300698022.00002E4401598000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3296090281.00002E4401124000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282771314.00002E4400664000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282072996.00002E44005E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3158173267.0000022A0702D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://pcapp.store/api/api.php
Source: chrome.exe, 00000001.00000002.3288660180.00002E4400B38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3296090281.00002E4401124000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/api/api.php.D
Source: Setup.exe, 00000000.00000003.1959048596.0000000000851000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/inst_cpg.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730700255692837&ve
Source: Setup.exe, 00000000.00000002.1959860535.0000000000795000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000002.2422645373.000000000082A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=&winver=
Source: chrome.exe, 00000001.00000002.3309812766.00004B18002F2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282528088.00002E4400644000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3283532479.00002E4400704000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3263841917.00000554002A4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3309236231.00004B1800238000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3290484127.00002E4400C9C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287816760.00002E4400A5C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa
Source: chrome.exe, 00000001.00000002.3291132244.00002E4400CF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/js?id=G-VFQWFX3X1C
Source: chrome.exe, 00000001.00000002.3283532479.00002E4400704000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3298376059.00002E440133C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299160032.00002E4401420000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299654440.00002E4401478000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico
Source: chrome.exe, 00000001.00000002.3302844687.00002E4401918000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299160032.00002E4401420000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico.D
Source: chrome.exe, 00000001.00000002.3283532479.00002E4400704000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico5
Source: chrome.exe, 00000001.00000002.3298376059.00002E440133C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.icoD
Source: chrome.exe, 00000001.00000002.3276167096.00002E4400290000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3291132244.00002E4400CF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/lpd_installing_r2/src/lpd_installing_r2.min.js?nocache=1709636059406
Source: chrome.exe, 00000001.00000002.3306568940.00002E4401C4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/p.storeg
Source: chrome.exe, 00000001.00000002.3295757568.00002E44010E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=173070025569
Source: Setup.exe, 00000000.00000003.1716247366.0000000002BC4000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1959048596.00000000007E2000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2276476606.0000000003883000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2280505164.00000000008DB000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2421188429.0000000000888000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2421188429.0000000000876000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2279413116.00000000008DB000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2278487106.00000000008DB000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2264244768.0000000000888000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2283729387.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2279057516.00000000008DB000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2276629062.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2281204808.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2281350528.00000000008D9000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000002.2422927453.0000000000876000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2279295663.00000000008DB000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000002.2422645373.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2264244768.0000000000876000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2264244768.000000000088B000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000002.2422927453.0000000000888000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.2986765549.0000017F0FCD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixel.gif?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&version=fa.1092c&evt_src=fa_
Source: Setup.exe, 00000000.00000003.1958885351.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1959307385.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1960683749.0000000002C2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixel.gif?guid=stallation?2
Source: chrome.exe, 00000001.00000002.3302844687.00002E4401918000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3301460992.00002E4401610000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302743582.00002E4401910000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282282304.00002E4400618000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.php
Source: chrome.exe, 00000001.00000002.3302743582.00002E4401910000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.phpBF0
Source: chrome.exe, 00000001.00000002.3302844687.00002E4401918000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.phpderValidator
Source: chrome.exe, 00000001.00000002.3302743582.00002E4401910000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.phpm
Source: Setup.exe, 00000000.00000002.1959860535.0000000000795000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_min
Source: Setup.exe, 00000000.00000002.1959860535.0000000000795000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000002.2422645373.000000000082A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/tos.html?guid=
Source: Setup.exe, 00000000.00000002.1960531364.0000000002BA2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/z
Source: chrome.exe, 00000001.00000002.3292498996.00002E4400EE9000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287938694.00002E4400A7C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store1
Source: chrome.exe, 00000001.00000002.3284776588.00002E44007B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store:443
Source: chrome.exe, 00000001.00000002.3304460754.00002E4401AD0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3274274008.00002E4400184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3307734111.00002E4401E48000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000001.00000002.3279343928.00002E4400390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeAccess-Coro
Source: chrome.exe, 00000001.00000002.3308227519.00002E440218C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeDate:
Source: chrome.exe, 00000001.00000002.3308227519.00002E440218C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3304612329.00002E4401AEC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3217065137.0000022A09607000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3266797386.00002E4400058000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287414017.00002E4400A1C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272102411.00002E44000DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeH
Source: chrome.exe, 00000001.00000002.3285222135.00002E440082C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3274347534.00002E4400194000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287217726.00002E44009EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeHX
Source: chrome.exe, 00000001.00000002.3292668948.00002E4400EFD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storewww.googletagmanager.com_default
Source: chrome.exe, 00000001.00000002.3292668948.00002E4400EFD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storewww.googletagmanager.com_default/
Source: chrome.exe, 00000001.00000002.3293373391.00002E4400F90000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.c
Source: chrome.exe, 00000001.00000002.3267856682.00002E4400064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000001.00000002.3267856682.00002E4400064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000001.00000002.3284650245.00002E44007A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3284650245.00002E44007A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000001.00000002.3297134744.00002E44011C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-VFQWFX3X1C&cid=1240658382.1730700453&gtm=45je4au
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000001.00000002.3287414017.00002E4400A1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net
Source: chrome.exe, 00000001.00000002.3300166610.00002E44014C8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299577954.00002E4401464000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/
Source: chrome.exe, 00000001.00000002.3287414017.00002E4400A1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/bjs
Source: chrome.exe, 00000001.00000002.3287414017.00002E4400A1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/bts
Source: chrome.exe, 00000001.00000002.3293233576.00002E4400F84000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=1240658382.1730700453&gtm=45je4au0v89864
Source: chrome.exe, 00000001.00000002.3295371176.00002E44010AC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3170135497.0000022A08F8D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730700452881&cv=11&fst=1730700452881&fmt=3&bg=ff
Source: chrome.exe, 00000001.00000002.3295371176.00002E44010AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730700452912&cv=11&fst=1730700452912&fmt=3&bg=ff
Source: chrome.exe, 00000001.00000002.3286297202.00002E440091C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3303264999.00002E440194C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3170135497.0000022A08F87000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3170135497.0000022A08F8D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730700453732&cv=11&fst=1730700453732&fmt=3&bg=ff
Source: chrome.exe, 00000001.00000002.3287414017.00002E4400A1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/update?ig_name=4s977639762.1730700453
Source: chrome.exe, 00000001.00000002.3307447329.00002E4401E1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net4s977639762.1730700453
Source: chrome.exe, 00000001.00000002.3307447329.00002E4401E1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net4s977639762.1730700453/
Source: chrome.exe, 00000001.00000002.3291029383.00002E4400CE4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.neter.comccoofpliimaahmaaome
Source: chrome.exe, 00000001.00000002.3307447329.00002E4401E1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.nethttps://pcapp.store
Source: chrome.exe, 00000001.00000002.3307447329.00002E4401E1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.nethttps://pcapp.store/
Source: chrome.exe, 00000001.00000002.3287414017.00002E4400A1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=681164326060&cv_id=1&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=681210400247&cv_id=2&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=682239234212&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3307447329.00002E4401E1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=1637665979
Source: chrome.exe, 00000001.00000002.3287414017.00002E4400A1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820411&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820414&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3307447329.00002E4401E1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820429&cv_i
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299577954.00002E4401464000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820429&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820432&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820444&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820450&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820453&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820456&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688795175019&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688917203998&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3306854362.00002E4401DA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://update.googleapis.com/service/update2/json
Source: chrome.exe, 00000001.00000002.3288206158.00002E4400A8C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3280355587.00002E4400514000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://update.googleapis.com/service/update2/json?cup2key=13:34TouWbfMlO4OZtrb2n5pabDq4RF-8698BMjqN
Source: chrome.exe, 00000001.00000002.3308515539.00002E4402248000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ww.googletagmanager.com
Source: chrome.exe, 00000001.00000002.3284776588.00002E44007B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000001.00000002.3280263026.00002E44004F0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282072996.00002E44005E0000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.2986765549.0000017F0FCD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000002.3286297202.00002E440091C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284776588.00002E44007B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000001.00000002.3286297202.00002E440091C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284776588.00002E44007B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTg
Source: chrome.exe, 00000001.00000002.3279757116.00002E440049C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thi
Source: chrome.exe, 00000001.00000002.3300849110.00002E44015BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmpp
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcn
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompe
Source: chrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckho
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acisphmku46ptpbe4irtwh7guyza_9269/hfnkpimlhhgiea
Source: chrome.exe, 00000001.00000002.3282528088.00002E4400644000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/aclacns2lwpknygjwzhz5vqbtzhq_1118/efniojlnjndmcb
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnk
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/ee
Source: chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocnca
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabj
Source: chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgk
Source: chrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindg
Source: chrome.exe, 00000001.00000002.3282528088.00002E4400644000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkh
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkke
Source: chrome.exe, 00000001.00000002.3288741424.00002E4400B50000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3281992365.00002E44005BC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3280009360.00002E44004D8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000002.3306527056.00002E4401C20000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/pagead/1p-user-list/858128210/?random=1730700452881&cv=11&fst=1730700000000&b
Source: chrome.exe, 00000001.00000002.3295371176.00002E44010BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/pagead/1p-user-list/858128210/?random=1730700452912&cv=11&fst=1730700000000&b
Source: chrome.exe, 00000001.00000002.3306527056.00002E4401C20000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3295371176.00002E44010BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/pagead/1p-user-list/858128210/?random=1730700453732&cv=11&fst=1730700000000&b
Source: chrome.exe, 00000001.00000002.3279233878.00002E4400380000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000001.00000002.3279233878.00002E4400380000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit.D
Source: chrome.exe, 00000001.00000002.3149005354.0000022A06F7D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000001.00000002.3308227519.00002E440218C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3304612329.00002E4401AEC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3217065137.0000022A09607000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3285222135.00002E440082C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3274347534.00002E4400194000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3266797386.00002E4400058000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287414017.00002E4400A1C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287217726.00002E44009EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272102411.00002E44000DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com.DjV
Source: chrome.exe, 00000001.00000002.3292668948.00002E4400EFD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299160032.00002E4401420000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/
Source: chrome.exe, 00000001.00000002.3302654754.00002E44018F0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/7
Source: chrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289838570.00002E4400C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=AW-858128210
Source: chrome.exe, 00000001.00000002.3288660180.00002E4400B38000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=AW-858128210R
Source: chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
Source: chrome.exe, 00000001.00000002.3274177851.00002E440017C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store
Source: chrome.exe, 00000001.00000002.3307073662.00002E4401DCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3276745313.00002E44002C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeH
Source: chrome.exe, 00000001.00000002.3274274008.00002E4400184000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeHX
Source: chrome.exe, 00000001.00000002.3304159913.00002E4401A7C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeaf
Source: chrome.exe, 00000001.00000002.3305395954.00002E4401B58000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3306047814.00002E4401BD4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3304760606.00002E4401B08000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storepp
Source: chrome.exe, 00000001.00000002.3306568940.00002E4401C4C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeto
Source: chrome.exe, 00000001.00000002.3304760606.00002E4401B08000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fpcap
Source: chrome.exe, 00000001.00000002.3177907218.0000022A08FB7000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.comH
Source: chrome.exe, 00000001.00000002.3294418213.00002E4401040000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3279757116.00002E440049C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000001.00000002.3292668948.00002E4400EFD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.jsdelivr.com/using-sri-with-dynamic-files
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000001.00000002.3276745313.00002E44002C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_004056DE
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindows user hook set: 0 mouse low level C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpCode function: 9_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,9_2_00403640
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040755C0_2_0040755C
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406D850_2_00406D85
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpCode function: 9_2_00406D5F9_2_00406D5F
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC1095B010_2_00007FF7BC1095B0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2D127410_2_00007FF7BC2D1274
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2BA80010_2_00007FF7BC2BA800
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2ADD8810_2_00007FF7BC2ADD88
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2C7DDC10_2_00007FF7BC2C7DDC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2C805810_2_00007FF7BC2C8058
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2C00EC10_2_00007FF7BC2C00EC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2BB98810_2_00007FF7BC2BB988
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2AD98410_2_00007FF7BC2AD984
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2C1A5C10_2_00007FF7BC2C1A5C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2B556010_2_00007FF7BC2B5560
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2876A810_2_00007FF7BC2876A8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2BB6A410_2_00007FF7BC2BB6A4
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2AB27410_2_00007FF7BC2AB274
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2C13DC10_2_00007FF7BC2C13DC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2AB47810_2_00007FF7BC2AB478
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2BEDA410_2_00007FF7BC2BEDA4
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC28CD9C10_2_00007FF7BC28CD9C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC29EE2410_2_00007FF7BC29EE24
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2AAE6410_2_00007FF7BC2AAE64
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2C0F4810_2_00007FF7BC2C0F48
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC0E0F2010_2_00007FF7BC0E0F20
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2CF00810_2_00007FF7BC2CF008
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2AB06810_2_00007FF7BC2AB068
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2BC9C410_2_00007FF7BC2BC9C4
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2AAA5410_2_00007FF7BC2AAA54
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2C2B9410_2_00007FF7BC2C2B94
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2D0BD810_2_00007FF7BC2D0BD8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2AAC5810_2_00007FF7BC2AAC58
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2AC75C10_2_00007FF7BC2AC75C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2AC3D810_2_00007FF7BC2AC3D8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9816AB811_2_00007FF6E9816AB8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E981033011_2_00007FF6E9810330
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E980D94811_2_00007FF6E980D948
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9808CD011_2_00007FF6E9808CD0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E980E45C11_2_00007FF6E980E45C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E98123C011_2_00007FF6E98123C0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9808EDC11_2_00007FF6E9808EDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9809F2011_2_00007FF6E9809F20
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E980DDDC11_2_00007FF6E980DDDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E97FED5011_2_00007FF6E97FED50
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E98090E811_2_00007FF6E98090E8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E981285C11_2_00007FF6E981285C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E980C7C411_2_00007FF6E980C7C4
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E980175411_2_00007FF6E9801754
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp F42D2BF4A50AB0CDB4A1C43964F0429C4663E27C76D8C61AFA174A531A7819A1
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\NSISFastLib.dll 6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF7BC09FCC0 appears 57 times
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF7BC090F30 appears 102 times
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF7BC0911A0 appears 403 times
Source: NW_store.exe.9.drStatic PE information: Number of sections : 13 > 10
Source: nw.dll.9.drStatic PE information: Number of sections : 15 > 10
Source: vk_swiftshader.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: libEGL.dll.9.drStatic PE information: Number of sections : 12 > 10
Source: node.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: nw_elf.dll.9.drStatic PE information: Number of sections : 14 > 10
Source: libGLESv2.dll.9.drStatic PE information: Number of sections : 12 > 10
Source: notification_helper.exe.9.drStatic PE information: Number of sections : 13 > 10
Source: Setup.exe, 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameinetc.dllF vs Setup.exe
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal51.spyw.evad.winEXE@34/291@0/28
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC098790 GetLastError,FormatMessageW,10_2_00007FF7BC098790
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpCode function: 9_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,9_2_00403640
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_0040498A
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E97FDBA0 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Concurrency::details::WorkQueue::IsStructuredEmpty,CloseHandle,Process32NextW,CloseHandle,11_2_00007FF6E97FDBA0
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_004021AA CoCreateInstance,0_2_004021AA
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC131860 FindResourceW,LoadResource,LockResource,SizeofResource,GlobalAlloc,GlobalLock,GlobalUnlock,CreateStreamOnHGlobal,GetLastError,10_2_00007FF7BC131860
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStoreJump to behavior
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2874.tmpJump to behavior
Source: Setup.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT sql FROM%d UNION ALL SELECT shell_add_schema(sql,mainNULL,name) AS sql, type, tbl_name, name, rowid, AS snum, AS sname FROM .sqlite_schema UNION ALL SELECT shell_module_schema(name), 'table', name, name, name, 9e+99, 'main' FROM pragma_module_list) WHERE %Qlower(printf('%s.%s',sname,tbl_name))lower(tbl_name) GLOB LIKE ESCAPE '\' AND name NOT LIKE 'sqlite_%%' AND sql IS NOT NULL ORDER BY snum, rowidSQL: %s;
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');%s
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT max(length(key)) FROM temp.sqlite_parameters;
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: CREATE TABLE ColNames( cpos INTEGER PRIMARY KEY, name TEXT, nlen INT, chop INT, reps INT, suff TEXT);CREATE VIEW RepeatedNames AS SELECT DISTINCT t.name FROM ColNames t WHERE t.name COLLATE NOCASE IN ( SELECT o.name FROM ColNames o WHERE o.cpos<>t.cpos);
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY name;
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT key, quote(value) FROM temp.sqlite_parameters;
Source: chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO selftest(tno,op,cmd,ans) SELECT rowid*10,op,cmd,ans FROM [_shell$self];
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;Warning: cannot step "%s" backwardsSELECT name, sql FROM sqlite_schema WHERE %sError: (%d) %s on [%s]
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT tbl,idx,stat FROM sqlite_stat1 ORDER BY tbl,idx;
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'EXPLAIN QUERY PLAN SELECT 1 FROM ' || quote(s.name) || ' WHERE ' || group_concat(quote(s.name) || '.' || quote(f.[from]) || '=?' || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]),' AND '), 'SEARCH ' || s.name || ' USING COVERING INDEX*(' || group_concat('*=?', ' AND ') || ')', s.name || '(' || group_concat(f.[from], ', ') || ')', f.[table] || '(' || group_concat(COALESCE(f.[to], p.[name])) || ')', 'CREATE INDEX ' || quote(s.name ||'_'|| group_concat(f.[from], '_')) || ' ON ' || quote(s.name) || '(' || group_concat(quote(f.[from]) || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]), ', ') || ');', f.[table] FROM sqlite_schema AS s, pragma_foreign_key_list(s.name) AS f LEFT JOIN pragma_table_info AS p ON (pk-1=seq AND p.arg=f.[table]) GROUP BY s.name, f.id ORDER BY (CASE WHEN ? THEN f.[table] ELSE s.name END)
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;ALTER TABLE temp.%Q RENAME TO %QINSERT INTO %Q VALUES(, %s?)UPDATE %Q SET , %s%Q=?DELETE FROM %QSELECT type, name, sql, 1 FROM sqlite_schema WHERE type IN ('table','view') AND name NOT LIKE 'sqlite_%%' UNION ALL SELECT type, name, sql, 2 FROM sqlite_schema WHERE type = 'trigger' AND tbl_name IN(SELECT name FROM sqlite_schema WHERE type = 'view') ORDER BY 4, 1CREATE TABLE x(, %s%Q COLLATE %s)CREATE VIRTUAL TABLE %Q USING expert(%Q)SELECT max(i.seqno) FROM sqlite_schema AS s, pragma_index_list(s.name) AS l, pragma_index_info(l.name) AS i WHERE s.type = 'table', %sx.%Q IS rem(%d, x.%Q) COLLATE %s%s%dSELECT %s FROM %Q x ORDER BY %sSELECT %s FROM temp.t592690916721053953805701627921227776 x ORDER BY %s%d %dDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776CREATE TABLE temp.t592690916721053953805701627921227776 AS SELECT * FROM %QSELECT s.rowid, s.name, l.name FROM sqlite_schema AS s, pragma_index_list(s.name) AS l WHERE s.type = 'table'SELECT name, coll FROM pragma_index_xinfo(?) WHERE keyINSERT INTO sqlite_stat1 VALUES(?, ?, ?)ANALYZE; PRAGMA writable_schema=1remsampleDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776ANALYZE sqlite_schemaDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776:memory::memory:SELECT sql FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%%' AND sql NOT LIKE 'CREATE VIRTUAL %%'Cannot find a unique index name to propose. -- stat1: %s;%s%s
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT OR IGNORE INTO "%s" VALUES(?,?);Error %d: %s on [%s]
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2302909769.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395972202.00007FF7BC332000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2403150838.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT name,seq FROM sqlite_sequence ORDER BY name;
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\user\Desktop\Setup.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241104010727.305&_fcid=1730700255692837
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5236 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp "C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241104010824.6836367156 /ver=fa.1092c
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241104010727.305&_fcid=1730700255692837Jump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp "C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /forceJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5236 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241104010824.6836367156 /ver=fa.1092cJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ieframe.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mlang.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiamanager.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: apphelp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: windows.storage.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wldp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: uxtheme.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wininet.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mswsock.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winnsi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dnsapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: schannel.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ntasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: msasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptsp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rsaenh.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptbase.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: gpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncrypt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dll
Source: C:\Windows\explorer.exeSection loaded: cdprt.dll
Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dll
Source: C:\Windows\explorer.exeSection loaded: provsvc.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: msvcp140.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: capabilityaccessmanagerclient.dll
Source: C:\Windows\explorer.exeSection loaded: windows.internal.shell.broker.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: version.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wlanapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dwmapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: secur32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: amsi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: userenv.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeSection loaded: oleacc.dll
Source: C:\Users\user\Desktop\Setup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: PC App Store.lnk.9.drLNK file: ..\..\..\..\..\..\PCAppStore\PcAppStore.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStoreJump to behavior
Source: Setup.exeStatic PE information: certificate valid
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsa4E4E.tmp, 00000009.00000002.2423520385.00000000027CC000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000000.2303366152.00007FF6E981A000.00000002.00000001.01000000.00000017.sdmp, Watchdog.exe, 0000000B.00000002.2929649453.00007FF6E981A000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002EB7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000000E.00000002.2908026871.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000010.00000000.2371350987.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000011.00000000.2373958479.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000012.00000000.2377787528.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000013.00000002.2908042981.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000014.00000002.2908028011.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000015.00000002.2908006805.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000016.00000002.2916220655.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000018.00000002.2912021981.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000019.00000002.2908039532.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001A.00000002.2908033293.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001B.00000000.2414237920.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001C.00000000.2416329357.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001D.00000002.2908382870.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001E.00000002.2908696093.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 0000001F.00000000.2422609116.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000020.00000002.2908553464.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000021.00000002.2908037750.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000022.00000002.2908002299.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000023.00000002.2908040521.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000024.00000002.2908034532.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000025.00000002.2916650078.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000026.00000002.2908036782.000000000047E000.00000002.00000001.01000000.00000019.sdmp, CdHffnRZmAeqywugPqpABCcYuGUADn.exe, 00000027.00000000.24347701
Source: Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\engine\Release\PCAppStore.pdb source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2302747427.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000002.2402968519.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 00000017.00000000.2395883794.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002EB7000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC0EBFE0 atomic,atomic,LoadLibraryW,GetProcAddress,atomic,atomic,type_info::_name_internal_method,Concurrency::details::WorkQueue::IsStructuredEmpty,LoadLibraryW,Concurrency::details::_Scheduler::_Scheduler,GetProcAddress,atomic,10_2_00007FF7BC0EBFE0
Source: Setup.exeStatic PE information: real checksum: 0x3937f should be: 0x33b1c
Source: NW_store.exe.9.drStatic PE information: real checksum: 0x0 should be: 0x23ab08
Source: System.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x3d68
Source: System.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x3d68
Source: vk_swiftshader.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x44caa7
Source: ffmpeg.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x1f8136
Source: nsJSON.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x6718
Source: NSISFastLib.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x30512
Source: inetc.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x13c41
Source: vulkan-1.dll.9.drStatic PE information: real checksum: 0x0 should be: 0xe0b14
Source: libEGL.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x7ddc6
Source: nsJSON.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x6718
Source: Math.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x155a8
Source: nw_elf.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x124d11
Source: NSISFastLib.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x30512
Source: inetc.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x13c41
Source: libGLESv2.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x7b9652
Source: notification_helper.exe.9.drStatic PE information: real checksum: 0x0 should be: 0x11edb8
Source: nsDialogs.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x2f9b
Source: NW_store.exe.9.drStatic PE information: section name: .gxfg
Source: NW_store.exe.9.drStatic PE information: section name: .retplne
Source: NW_store.exe.9.drStatic PE information: section name: .voltbl
Source: NW_store.exe.9.drStatic PE information: section name: CPADinfo
Source: NW_store.exe.9.drStatic PE information: section name: _RDATA
Source: NW_store.exe.9.drStatic PE information: section name: malloc_h
Source: ffmpeg.dll.9.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.9.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.9.drStatic PE information: section name: .voltbl
Source: ffmpeg.dll.9.drStatic PE information: section name: _RDATA
Source: libEGL.dll.9.drStatic PE information: section name: .gxfg
Source: libEGL.dll.9.drStatic PE information: section name: .retplne
Source: libEGL.dll.9.drStatic PE information: section name: .voltbl
Source: libEGL.dll.9.drStatic PE information: section name: _RDATA
Source: libEGL.dll.9.drStatic PE information: section name: malloc_h
Source: libGLESv2.dll.9.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.9.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.9.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll.9.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.9.drStatic PE information: section name: malloc_h
Source: node.dll.9.drStatic PE information: section name: .gxfg
Source: node.dll.9.drStatic PE information: section name: .retplne
Source: node.dll.9.drStatic PE information: section name: .voltbl
Source: node.dll.9.drStatic PE information: section name: _RDATA
Source: notification_helper.exe.9.drStatic PE information: section name: .gxfg
Source: notification_helper.exe.9.drStatic PE information: section name: .retplne
Source: notification_helper.exe.9.drStatic PE information: section name: .voltbl
Source: notification_helper.exe.9.drStatic PE information: section name: CPADinfo
Source: notification_helper.exe.9.drStatic PE information: section name: _RDATA
Source: notification_helper.exe.9.drStatic PE information: section name: malloc_h
Source: nw.dll.9.drStatic PE information: section name: .gxfg
Source: nw.dll.9.drStatic PE information: section name: .retplne
Source: nw.dll.9.drStatic PE information: section name: .rodata
Source: nw.dll.9.drStatic PE information: section name: .voltbl
Source: nw.dll.9.drStatic PE information: section name: CPADinfo
Source: nw.dll.9.drStatic PE information: section name: LZMADEC
Source: nw.dll.9.drStatic PE information: section name: _RDATA
Source: nw.dll.9.drStatic PE information: section name: malloc_h
Source: nw_elf.dll.9.drStatic PE information: section name: .crthunk
Source: nw_elf.dll.9.drStatic PE information: section name: .gxfg
Source: nw_elf.dll.9.drStatic PE information: section name: .retplne
Source: nw_elf.dll.9.drStatic PE information: section name: .voltbl
Source: nw_elf.dll.9.drStatic PE information: section name: CPADinfo
Source: nw_elf.dll.9.drStatic PE information: section name: _RDATA
Source: nw_elf.dll.9.drStatic PE information: section name: malloc_h
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .voltbl
Source: vk_swiftshader.dll.9.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.9.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.9.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.9.drStatic PE information: section name: .voltbl
Source: vulkan-1.dll.9.drStatic PE information: section name: _RDATA
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC0EF0B0 pushfq ; ret 10_2_00007FF7BC0EF0B1
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\Watchdog.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\PcAppStore.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txtJump to behavior

Boot Survival

barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\Desktop\Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
Source: C:\Users\user\Desktop\Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 396Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 806Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 2102Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: foregroundWindowGot 449Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6740Thread sleep count: 277 > 30
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6740Thread sleep time: -16620000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 5352Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 5352Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6740Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\PCAppStore\PcAppStore.exeLast function: Thread delayed
Source: C:\Users\user\PCAppStore\Watchdog.exeLast function: Thread delayed
Source: C:\Users\user\PCAppStore\Watchdog.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406873 FindFirstFileW,FindClose,0_2_00406873
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040290B FindFirstFileW,0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpCode function: 9_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,9_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpCode function: 9_2_0040699E FindFirstFileW,FindClose,9_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpCode function: 9_2_0040290B FindFirstFileW,9_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2875F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,10_2_00007FF7BC2875F8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2876A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,10_2_00007FF7BC2876A8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E98016E0 FindClose,FindFirstFileExW,GetLastError,11_2_00007FF6E98016E0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9810330 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,11_2_00007FF6E9810330
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9801754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,11_2_00007FF6E9801754
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: explorer.exe, 0000000C.00000002.3266039584.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: chrome.exe, 00000001.00000002.3288382085.00002E4400AD4000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware
Source: PcAppStore.exe, 00000017.00000003.2400580310.0000026E9E164000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductGWLZBS71434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.None+
Source: Watchdog.exe, 0000000B.00000002.2915988958.000002967056C000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000003.2800504677.0000029670591000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000003.2858849818.0000029670591000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000003.2582849949.0000029670591000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000003.2700435334.0000029670592000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWdWndClass
Source: chrome.exe, 00000001.00000002.3296476939.00002E4401148000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual USB Mouse
Source: explorer.exe, 0000000C.00000002.2911771019.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 0000000C.00000002.3048246300.00000000079FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: PcAppStore.exe, 00000017.00000003.2400610518.0000026E9E13E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
Source: PcAppStore.exe, 0000000A.00000002.2946493367.0000017F0D4AC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
Source: PcAppStore.exe, 00000017.00000003.2400610518.0000026E9E13E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductGWLZBS71434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.Noney*
Source: Setup.exe, 00000000.00000003.1654943491.0000000000840000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"3X_5W6K","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"E8_29GWO+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"CdHffnRZmAeqywugPqpABCcYuGUADn%2Eexe","2":"Memory+Compression","3":"OfficeClickToRun%2Eexe","4":"Registry","5":"RuntimeBroker%2Eexe","6":"SearchApp%2Eexe","7":"Setup%2Eexe","8":"SgrmBroker%2Eexe","9":"StartMenuExperienceHost%2Eexe","10":"System","11":"SystemSettings%2Eexe","12":"TextInputHost%2Eexe",
Source: PcAppStore.exe, 0000000A.00000003.2305355940.0000017F0D509000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tem ProductGWLZBS71434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.Noney*
Source: Setup.exe, 00000000.00000003.1959048596.0000000000851000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1960531364.0000000002BA2000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2421188429.0000000000888000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2421188429.0000000000876000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000002.2422927453.0000000000876000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2264244768.0000000000876000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2264244768.000000000088B000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000002.2422927453.0000000000888000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.2946493367.0000017F0D562000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.2915988958.000002967056C000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.2915988958.00000296705FA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: Setup.exe, 00000000.00000003.1654943491.0000000000830000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"3X_5W6K","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"E8_29GWO+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"CdHffnRZmAeqywugPqpABCcYuGUADn%2Eexe","2":"Memory+Compression",
Source: chrome.exe, 00000001.00000002.3288660180.00002E4400B38000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=168f8fe9-9607-4a53-a5ec-2b75f9c41646
Source: nsa4E4E.tmp, 00000009.00000002.2422927453.0000000000888000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware%2C+Inc%2E
Source: explorer.exe, 0000000C.00000000.2341862838.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: PcAppStore.exe, 00000017.00000002.2401822433.0000026E9E14F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx8%SystemRoot%\system32\mswsock.dll=C`u
Source: Setup.exe, 00000000.00000002.1959860535.0000000000795000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.i
Source: chrome.exe, 00000001.00000002.3101160298.0000022A02E9B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PcAppStore.exe, 0000000A.00000002.3029246026.0000017F105FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDev
Source: explorer.exe, 0000000C.00000000.2340146738.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 0000000C.00000000.2340146738.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 0000000C.00000002.3266039584.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000C.00000000.2325239907.00000000079FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: Setup.exe, 00000000.00000003.1655117545.0000000000815000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"3X_5W6K","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"E8_29GWO+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration",
Source: nsa4E4E.tmp, 00000009.00000003.2280793278.000000000387B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: LstringVMware, Inc.4
Source: explorer.exe, 0000000C.00000000.2341862838.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
Source: nsa4E4E.tmp, 00000009.00000003.2281350528.00000000008D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: LstringVMware, Inc.t32g+$
Source: explorer.exe, 0000000C.00000002.3048246300.00000000078AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTTAVMWare
Source: Setup.exe, 00000000.00000003.1655357724.0000000000841000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"3X_5W6K","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"E8_29GWO+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"CdHffnRZmAeqywugPqpABCcYuGUADn%2Eexe","2":"Memory+Compression","3":"OfficeClickToRun%2Eexe","4":"Registry","5":"RuntimeBroker%2Eexe","6":"SearchApp%2Eexe","7":"Setup%2Eexe","8":"SgrmBroker%2Eexe","9":"StartMenuExperienceHost%2Eexe","10":"System","11":"SystemSettings%2Eexe","12":"TextInputHost%2Eexe","13":"UserOOBEBroker%2Eexe","14":"WinStore%2EApp%2Eexe","15":"WmiPrvSE%2Eexe","16":"%5BSystem+Process%5D","17":"audiodg%2Eexe","18":"backgroundTaskHost%2Eexe","19":"conhost%2Eexe","20":"csrss%2Eexe","21":"ctfmon%2Eexe","22":"dasHost%2Eexe","23":"dllhost%2Eexe","24":"dwm%2Eexe",
Source: explorer.exe, 0000000C.00000000.2340146738.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: tempPOSTData.9.drBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"3X_5W6K","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"E8_29GWO+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"CdHffnRZmAeqywugPqpABCcYuGUADn%2Eexe","2":"Memory+Compression","3":"OfficeClickToRun%2Eexe","4":"Registry","5":"RuntimeBroker%2Eexe","6":"SearchApp%2Eexe","7":"SgrmBroker%2Eexe","8":"StartMenuExperienceHost%2Eexe","9":"System","10":"SystemSettings%2Eexe","11":"TextInputHost%2Eexe","12":"UserOOBEBroker%2Eexe","13":"WinStore%2EApp%2Eexe","14":"WmiPrvSE%2Eexe","15":"%5BSystem+Process%5D","16":"audiodg%2Eexe","17":"chrome%2Eexe","18":"conhost%2Eexe","19":"csrss%2Eexe","20":"ctfmon%2Eexe","21":"dasHost%2Eexe","22":"dllhost%2Eexe","23":"dwm%2Eexe","24":"explorer%2Eexe","25":"fontdrvhost%2Eexe","26":"lsass%2Eexe","27":"nsa4E4E%2Etmp","28":"services%2Eexe","29":"sihost%2Eexe","30":"smartscreen%2Eexe","31":"smss%2Eexe","32":"spoolsv%2Eexe","33":"svchost%2Eexe","34":"wininit%2Eexe","35":"winlogon%2Eexe"}}
Source: Setup.exe, 00000000.00000003.1655117545.000000000083E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"3X_5W6K","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"E8_29GWO+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"CdHffnRZmAeqywugPqpABCcYuGUADn%2Eexe","2":"Memory+Compression","3":"OfficeClickToRun%2Eexe","4":"Registry","5":"RuntimeBroker%2Eexe","6":"SearchApp%2Eexe","7":"Setup%2Eexe","8":"SgrmBroker%2Eexe","9":"StartMenuExperienceHost%2Eexe","10":"System","11":"SystemSettings%2Eexe","12":"TextInputHost%2Eexe","13":"UserOOBEBroker%2Eexe","14":"WinStore%2EApp%2Eexe","15":"WmiPrvSE%2Eexe","16":"%5BSystem+Process%5D","17":"audiodg%2Eexe","18":"backgroundTaskHost%2Eexe","19":"conhost%2Eexe","20":"csrss%2Eexe","21":"ctfmon%2Eexe","22":"dasHost%2Eexe","23":"dllhost%2Eexe","24":"dwm%2Eexe",
Source: nsa4E4E.tmp, 00000009.00000003.2421188429.0000000000888000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000003.2264244768.000000000088B000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000002.2422927453.0000000000888000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWJ
Source: nsa4E4E.tmp, 00000009.00000002.2422927453.0000000000888000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.U
Source: PcAppStore.exe, 00000017.00000003.2400580310.0000026E9E164000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tComputer System ProductGWLZBS71434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.Noney*
Source: explorer.exe, 0000000C.00000000.2325239907.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3048246300.0000000007A34000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBnx
Source: chrome.exe, 00000001.00000002.3288660180.00002E4400B38000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=168f8fe9-9607-4a53-a5ec-2b75f9c41646.D
Source: Setup.exe, 00000000.00000003.1655117545.000000000083E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"3X_5W6K","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"E8_29GWO+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"CdHffnRZmAeqywugPqpABCcYuGUADn%2Eexe","2":"Memory+Compression","3":"OfficeClickToRun%2Eexe","4":"Registry","5":"RuntimeBroker%2Eexe","6":"SearchApp%2Eexe","7":"Setup%2Eexe","8":"SgrmBroker%2Eexe","9":"StartMenuExperienceHost%2Eexe","10":"System","11":"SystemSettings%2Eexe","12":"TextInputHost%2Eexe","13":"UserOOBEBroker%2Eexe","14":"WinStore%2EApp%2Eexe","15":"WmiPrvSE%2Eexe","16":"%5BSystem+Process%5D","17":"audiodg%2Eexe","18":"backgroundTaskHost%2Eexe","19":"conhost%2Eexe","20":"csrss%2Eexe","21":"ctfmon%2Eexe","22":"dasHost%2Eexe","23":"dllhost%2Eexe","24":"dwm%2Eexe","25":"explorer%2Eexe","26":"fontdrvhost%2Eexe","27":"lsass%2Eexe","28":"services%2Eexe","29":"sihost%2Eexe","30":"smartscreen%2Eexe","31":"smss%2Eexe","32":"spoolsv%2Eexe","33":"svchost%2Eexe","34":"upfc%2Eexe","35":"wininit%2Eexe","36":"winlogon%2Eexe"},"sys_lang":"en-GB","parent_proc":"explorer%2Eexe"}
Source: Setup.exe, 00000000.00000003.1655117545.0000000000815000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ~stem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"3X_5W6K","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"E8_29GWO+SCSI+Disk+Device",
Source: explorer.exe, 0000000C.00000002.3249401633.0000000009660000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 0000000C.00000002.2911771019.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000C.00000002.2911771019.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Desktop\Setup.exeAPI call chain: ExitProcess graph end nodegraph_0-3503
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpAPI call chain: ExitProcess graph end nodegraph_9-3481
Source: C:\Users\user\Desktop\Setup.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC281254 __vcrt_InitializeCriticalSectionEx,GetLastError,IsDebuggerPresent,OutputDebugStringW,10_2_00007FF7BC281254
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC281254 __vcrt_InitializeCriticalSectionEx,GetLastError,IsDebuggerPresent,OutputDebugStringW,10_2_00007FF7BC281254
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC0EBFE0 atomic,atomic,LoadLibraryW,GetProcAddress,atomic,atomic,type_info::_name_internal_method,Concurrency::details::WorkQueue::IsStructuredEmpty,LoadLibraryW,Concurrency::details::_Scheduler::_Scheduler,GetProcAddress,atomic,10_2_00007FF7BC0EBFE0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC111E10 std::bad_exception::bad_exception,GetProcessHeap,HeapAlloc,std::bad_alloc::bad_alloc,10_2_00007FF7BC111E10
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2A3990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00007FF7BC2A3990
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2A8CB8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00007FF7BC2A8CB8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E98031C0 SetUnhandledExceptionFilter,11_2_00007FF6E98031C0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9807EA8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_00007FF6E9807EA8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E980255C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,11_2_00007FF6E980255C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E9802FDC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_00007FF6E9802FDC

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtOpenKeyEx: Direct from: 0x76F02B9C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtOpenKeyEx: Direct from: 0x76F03C9C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtReadVirtualMemory: Direct from: 0x76F02E8C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtProtectVirtualMemory: Direct from: 0x76F02F9C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtSetInformationProcess: Direct from: 0x76F02C5C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtQueryAttributesFile: Direct from: 0x76F02E6C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtCreateMutant: Direct from: 0x76F035CC
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtMapViewOfSection: Direct from: 0x76F02D1C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtOpenSection: Direct from: 0x76F02E0C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtDeviceIoControlFile: Direct from: 0x76F02AEC
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFC
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtQueryValueKey: Direct from: 0x76F02BEC
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtAddAtomEx: Direct from: 0x76F0312C
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtCreateFile: Direct from: 0x76F02FEC
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtOpenFile: Direct from: 0x76F02DCC
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtSetInformationThread: Direct from: 0x76F02ECC
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtTerminateThread: Direct from: 0x76F02FCC
Source: C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exeNtQueryInformationProcess: Direct from: 0x76F02C26
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC115130 keybd_event,keybd_event,10_2_00007FF7BC115130
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241104010727.305&_fcid=1730700255692837Jump to behavior
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2302747427.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: C++/WinRT version:2.0.220110.5productr_binErreCode=%dproductcreate_shortcutshortcut_erroroid=%luSHGetFolderPath_error_code=%X&oid=%luQueryInterface_error_code=%X&oid=%luCoCreateInstance_error_code=%X&oid=%lu.lnknfinityan.lnkindsnanproductshortcut_delete_erroreC=%XnfinityanindsnanShell_TrayWnd0p+00p+0unknowninfnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)unknownLTRRTLLTRinfnan(ind)nannan(snan)infnan(ind)nannan(snan)type must be string, but is type must be number, but is type must be number, but is \\\HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGCurrentBuildBuildNumberSOFTWARE\Microsoft\Windows NT\CurrentVersionSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon%lu%02X\/Software\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\PCAppStoreAppParamdefaultauto_start_oncontextual_offersperiodical_offerspersonilized_notifications%us%5B%5D=\uparamsnametype must be string, but is paramsnameurloidentryAppfilePath0e+000e+00RoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll^(https?://(?:www.)?([^/]+))(/.*)?$.dllDllGetActivationFactoryURL format is not valid : %wsWinHTTP 1.0handle initialization failuretimeout init failurehandle connection failureGEThandle request creation failurehandle request or response failurefile creation failurequery data not availableurloidlastTimeoTypesessionIdtagretmessageRoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll.dllDllGetActivationFactoryiconnamepathoidanimationsoundmenu_storemenu_searchhttps://pcapp.storenamepathmicrosoftIdregpathkeydisplaycountblinkingnotificationIconrunParampathalt_linkmicrosoftIdregpathkeyidwinGetParamsaltActionaltActionParamsid
Source: PcAppStore.exe, 0000000A.00000002.2946493367.0000017F0D514000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
Source: PcAppStore.exe, 0000000A.00000002.2946493367.0000017F0D514000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager$
Source: chrome.exe, 00000001.00000002.3118081091.0000022A03661000.00000002.00000001.00040000.00000000.sdmp, PcAppStore.exe, explorer.exe, 0000000C.00000002.2922808889.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.3249401633.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2302747427.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: productui_creation_failedcreation_error=%wsui_termination_errordirectory_switching_error.\nwjs\NW_store.exe.\ui\.ENDING_EVT_HANDLERWindows Default Lock ScreenLocalPCAppStore\productsystem_eventmsg=shutdownshutdownproductsystem_eventmsg=logofflogoff{"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}ClosingEventproducttaskbar_handler_erroreCode=%luShell_TrayWndStartTrayDummySearchControlTrayButton
Source: chrome.exe, 00000001.00000002.3118081091.0000022A03661000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.2922808889.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2315226644.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2302747427.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: list too longStartMenuExperienceHost.exeShellExperienceHost.exeexplorer.exeSearchApp.exeSearchUI.exeSearchHost.exe{"app":{"menu_search":{"search_request":"", "page":"a", "top":%d,"left":%d,"bottom":%d,"right":%d},"show_window": "menu_search"}}{"app": {"hide_window": "menu_search"}}Shell_TrayWndStartTrayDummySearchControlTrayButton
Source: PcAppStore.exe, 0000000A.00000003.2460778833.0000017F0FC93000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.2460919949.0000017F0FCA1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndl
Source: explorer.exe, 0000000C.00000000.2314569212.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.2911771019.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman$
Source: chrome.exe, 00000001.00000002.3118081091.0000022A03661000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.2922808889.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2315226644.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: chrome.exe, 00000001.00000002.3118081091.0000022A03661000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.2922808889.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2315226644.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2302747427.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: TTaskbarShell_TrayWnd{"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
Source: nsa4E4E.tmp, 00000009.00000002.2423520385.0000000002BC0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000000.2302747427.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: NWidgetShell_TrayWndTrayNotifyWnd+TrayButtonPNGArial++
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF6E98167D0 cpuid 11_2_00007FF6E98167D0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,10_2_00007FF7BC2CE084
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,Concurrency::details::WorkQueue::IsStructuredEmpty,GetLocaleInfoEx,10_2_00007FF7BC107BE0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoW,10_2_00007FF7BC2C37E4
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: EnumSystemLocalesW,10_2_00007FF7BC2C324C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,10_2_00007FF7BC2CEACC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,FormatMessageA,10_2_00007FF7BC2868B0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,10_2_00007FF7BC2CE8E8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,10_2_00007FF7BC2A23BC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: EnumSystemLocalesW,10_2_00007FF7BC2CE3E0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: EnumSystemLocalesW,10_2_00007FF7BC2CE4B0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: GetLocaleInfoEx,FormatMessageA,11_2_00007FF6E9801448
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC287B24 GetSystemTimeAsFileTime,10_2_00007FF7BC287B24
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF7BC2C7DDC _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,10_2_00007FF7BC2C7DDC
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\PCAppStore\PcAppStore.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
Source: pt-PT.pak.info.9.drBinary or memory string: IDS_WIN_8_1_OBSOLETE,943,../../chrome/app/chromium_strings.grd
Source: pt-PT.pak.info.9.drBinary or memory string: IDS_WIN_XP_VISTA_OBSOLETE,940,../../chrome/app/chromium_strings.grd
Source: pt-PT.pak.info.9.drBinary or memory string: IDS_WIN_8_OBSOLETE,942,../../chrome/app/chromium_strings.grd
Source: pt-PT.pak.info.9.drBinary or memory string: IDS_WIN_7_OBSOLETE,941,../../chrome/app/chromium_strings.grd

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts141
Windows Management Instrumentation		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Deobfuscate/Decode Files or Information		1
OS Credential Dumping		2
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Native API		1
DLL Search Order Hijacking		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Input Capture		2
File and Directory Discovery		Remote Desktop Protocol1
Data from Local System		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Windows Service		1
DLL Search Order Hijacking		2
Obfuscated Files or Information		Security Account Manager155
System Information Discovery		SMB/Windows Admin Shares1
Input Capture		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron111
Registry Run Keys / Startup Folder		1
Access Token Manipulation		1
DLL Side-Loading		NTDS1
Query Registry		Distributed Component Object Model1
Clipboard Data		Protocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
Windows Service		1
DLL Search Order Hijacking		LSA Secrets261
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts12
Process Injection		1
Masquerading		Cached Domain Credentials141
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items111
Registry Run Keys / Startup Folder		141
Virtualization/Sandbox Evasion		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1548201 Sample: Setup.exe Startdate: 04/11/2024 Architecture: WINDOWS Score: 51 80 Multi AV Scanner detection for dropped file 2->80 82 Machine Learning detection for sample 2->82 9 Setup.exe 2 41 2->9         started        process3 dnsIp4 74 37.19.194.81 INTERTELECOMUA Ukraine 9->74 76 167.99.235.203 DIGITALOCEAN-ASNUS United States 9->76 44 C:\Users\user\AppData\Local\...\inetc.dll, PE32 9->44 dropped 46 C:\Users\user\AppData\...46SISFastLib.dll, PE32 9->46 dropped 48 C:\Users\user\AppData\Local\...\nsa4E4E.tmp, PE32 9->48 dropped 50 3 other files (none is malicious) 9->50 dropped 86 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 9->86 14 nsa4E4E.tmp 11 252 9->14         started        18 chrome.exe 1 9->18         started        file5 signatures6 process7 dnsIp8 52 C:\Users\user\PCAppStore\nwjs\vulkan-1.dll, PE32+ 14->52 dropped 54 C:\Users\user\...\vk_swiftshader.dll, PE32+ 14->54 dropped 56 C:\Users\user\PCAppStore\nwjs\nw_elf.dll, PE32+ 14->56 dropped 58 17 other files (14 malicious) 14->58 dropped 88 Multi AV Scanner detection for dropped file 14->88 90 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->90 92 Creates multiple autostart registry keys 14->92 21 PcAppStore.exe 3 14->21         started        25 Watchdog.exe 14->25         started        60 192.168.2.4 unknown unknown 18->60 62 239.255.255.250 unknown Reserved 18->62 27 chrome.exe 18->27         started        29 chrome.exe 18->29         started        31 chrome.exe 6 18->31         started        file9 signatures10 process11 dnsIp12 64 147.182.211.77 BV-PUBLIC-ASNUS United States 21->64 84 Tries to harvest and steal browser information (history, passwords, etc) 21->84 33 CdHffnRZmAeqywugPqpABCcYuGUADn.exe 21->33 injected 36 explorer.exe 21->36 injected 38 CdHffnRZmAeqywugPqpABCcYuGUADn.exe 21->38 injected 40 27 other processes 21->40 66 52.222.169.28 AMAZON-02US United States 25->66 68 207.211.211.27 NAVISITE-EAST-2US United States 27->68 70 142.250.181.232 GOOGLEUS United States 27->70 72 20 other IPs or domains 27->72 signatures13 process14 signatures15 78 Found direct / indirect Syscall (likely to bypass EDR) 33->78 42 PcAppStore.exe 36->42         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Setup.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp42%ReversingLabsWin32.PUA.Generic
C:\Users\user\AppData\Local\Temp\nsk2875.tmp\NSISFastLib.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk2875.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk2875.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk2875.tmp\nsDialogs.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsk2875.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\Math.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\NSISFastLib.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\PCAppStore\AutoUpdater.exe5%ReversingLabs
C:\Users\user\PCAppStore\PcAppStore.exe5%ReversingLabs
C:\Users\user\PCAppStore\Uninstaller.exe29%ReversingLabs
C:\Users\user\PCAppStore\Watchdog.exe5%ReversingLabs
C:\Users\user\PCAppStore\nwjs\NW_store.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\ffmpeg.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libEGL.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libGLESv2.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\node.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\notification_helper.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw_elf.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vulkan-1.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
https://duckduckgo.com/ac/?q=0%URL Reputationsafe
http://anglebug.com/46330%URL Reputationsafe
https://anglebug.com/73820%URL Reputationsafe
https://issuetracker.google.com/2844622630%URL Reputationsafe
https://anglebug.com/77140%URL Reputationsafe
http://anglebug.com/69290%URL Reputationsafe
https://issuetracker.google.com/2554117480%URL Reputationsafe
https://anglebug.com/72460%URL Reputationsafe
https://anglebug.com/73690%URL Reputationsafe
https://duckduckgo.com/?q=0%URL Reputationsafe
https://issuetracker.google.com/1619030060%URL Reputationsafe
https://www.ecosia.org/newtab/0%URL Reputationsafe
http://anglebug.com/30780%URL Reputationsafe
http://anglebug.com/53750%URL Reputationsafe
http://anglebug.com/53710%URL Reputationsafe
http://anglebug.com/47220%URL Reputationsafe
https://m.google.com/devicemanagement/data/api0%URL Reputationsafe
https://chromewebstore.google.com/0%URL Reputationsafe
https://mail.google.com/mail/?usp=installed_webapp0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

NameMaliciousAntivirus DetectionReputation
https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730700255692837&_winver=19045&version=fa.1092cfalse
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730700452912&cv=chrome.exe, 00000001.00000002.3307073662.00002E4401DCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3295371176.00002E44010AC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3177907218.0000022A08FBD000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3158173267.0000022A0702D000.00000004.00000001.00040000.00000000.sdmpfalse
      		unknown
      https://duckduckgo.com/chrome_newtabchrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://mail.google.com/mail/?usp=installed_webappchrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272102411.00002E44000DC000.00000004.00000001.00020000.00000000.sdmpfalseunknown
      https://duckduckgo.com/ac/?q=chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      https://stats.g.doubleclick.net/g/collect?v=2&tid=G-VFQWFX3X1C&cid=1240658382.1730700453&gtm=45je4auchrome.exe, 00000001.00000002.3297134744.00002E44011C4000.00000004.00000001.00020000.00000000.sdmpfalse
        		unknown
        https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditingchrome.exe, 00000001.00000002.3267856682.00002E4400064000.00000004.00000001.00020000.00000000.sdmpfalse
          		unknown
          https://pcapp.store/pixelgif.phpmchrome.exe, 00000001.00000002.3302743582.00002E4401910000.00000004.00000001.00020000.00000000.sdmpfalse
            		unknown
            http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjichrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpfalse
              		unknown
              https://pcapp.store/lp/appstore/img/favicon.ico.Dchrome.exe, 00000001.00000002.3302844687.00002E4401918000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299160032.00002E4401420000.00000004.00000001.00020000.00000000.sdmpfalse
                		unknown
                http://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjdchrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpfalse
                  		unknown
                  https://docs.google.com/document/Jchrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpfalse
                    		unknown
                    https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonechrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmpfalse
                      		unknown
                      http://anglebug.com/4633chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkkchrome.exe, 00000001.00000002.3272260342.00002E44000EC000.00000004.00000001.00020000.00000000.sdmpfalse
                        		unknown
                        https://anglebug.com/7382chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:chrome.exe, 00000001.00000002.3290405446.00002E4400C90000.00000004.00000001.00020000.00000000.sdmpfalse
                          		unknown
                          https://issuetracker.google.com/284462263chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://td.doubleclick.net/td/rul/858128210?random=1730700452912&cv=11&fst=1730700452912&fmt=3&bg=ffchrome.exe, 00000001.00000002.3295371176.00002E44010AC000.00000004.00000001.00020000.00000000.sdmpfalse
                            		unknown
                            https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklychrome.exe, 00000001.00000002.3284650245.00002E44007A4000.00000004.00000001.00020000.00000000.sdmpfalse
                              		unknown
                              https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_instaSetup.exe, 00000000.00000002.1959860535.0000000000795000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0.Dchrome.exe, 00000001.00000002.3307372583.00002E4401E0C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://dns-tunnel-check.googlezip.net/connectchrome.exe, 00000001.00000002.3302550833.00002E44018E8000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpnchrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		unknown
                                      http://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obedchrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://docs.google.com/document/:chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://anglebug.com/7714chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://td.doubleclick.net/chrome.exe, 00000001.00000002.3300166610.00002E44014C8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299577954.00002E4401464000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://unisolated.invalid/chrome.exe, 00000001.00000002.3286566361.00002E4400960000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://www.google.com/chrome/tips/chrome.exe, 00000001.00000002.3286297202.00002E440091C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284776588.00002E44007B8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		unknown
                                                http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanchrome.exe, 00000001.00000002.3280355587.00002E4400514000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://drive.google.com/?lfhs=2chrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx352.0/.Dchrome.exe, 00000001.00000002.3300849110.00002E44015BC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://m.google.com/devicemanagement/data/api.Dchrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://anglebug.com/6929chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://www.google.com/dl/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14chrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          http://anglebug.com/8215xchrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://pcapp.store/p.storegchrome.exe, 00000001.00000002.3306568940.00002E4401C4C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://pcapp.store/tos.html?guid=Setup.exe, 00000000.00000002.1959860535.0000000000795000.00000004.00000020.00020000.00000000.sdmp, nsa4E4E.tmp, 00000009.00000002.2422645373.000000000082A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompechrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  https://www.youtube.com/?feature=ytcachrome.exe, 00000001.00000002.3282980444.00002E44006AD000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://issuetracker.google.com/255411748chrome.exe, 00000001.00000002.3293487083.00002E4400FB0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    https://www.google.com/pagead/1p-user-list/858128210/?random=1730700453732&cv=11&fst=1730700000000&bchrome.exe, 00000001.00000002.3306527056.00002E4401C20000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3295371176.00002E44010BC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://csp.withgoogle.com/csp/analytics-container-tag-servingCross-Origin-Resource-Policy:chrome.exe, 00000001.00000002.3287635345.00002E4400A28000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://docs.google.com/document/u/0/create?usp=chrome_actionschrome.exe, 00000001.00000002.3284650245.00002E44007A4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://pcapp.store/pixelgif.phpchrome.exe, 00000001.00000002.3302844687.00002E4401918000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3301460992.00002E4401610000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302743582.00002E4401910000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282282304.00002E4400618000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://anglebug.com/7246chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://anglebug.com/7369chrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282072996.00002E44005E0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://duckduckgo.com/?q=chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://pcapp.store/inst_cpg.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730700255692837&veSetup.exe, 00000000.00000003.1959048596.0000000000851000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeachrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://microsoft.coSetup.exe, 00000000.00000003.1716247366.0000000002BD1000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1697332689.0000000002BD1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://chrome.google.com/webstorechrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3282072996.00002E44005E0000.00000004.00000001.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.2986765549.0000017F0FCD1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://pcapp.stchrome.exe, 00000001.00000002.3307664353.00002E4401E40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3276052785.00002E440027C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3296397148.00002E4401138000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820456&cv_id=0&format=$chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://doubleclick.net/t/.chrome.exe, 00000001.00000002.3300698022.00002E4401598000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3chrome.exe, 00000001.00000002.3300849110.00002E44015BC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://cdn.ecosia.org/assets/images/ico/favicon.icochrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://pcapp.storechrome.exe, 00000001.00000002.3292498996.00002E4400EE9000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3274274008.00002E4400184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289183484.00002E4400BA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3307147605.00002E4401DDC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3291029383.00002E4400CE4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3279343928.00002E4400390000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287938694.00002E4400A7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3307734111.00002E4401E48000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                http://anglebug.com/5881wchrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjchrome.exe, 00000001.00000002.3287114917.00002E44009AC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://issuetracker.google.com/161903006chrome.exe, 00000001.00000002.3293670207.00002E4400FCC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    https://www.ecosia.org/newtab/chrome.exe, 00000001.00000002.3284776588.00002E44007B8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnfchrome.exe, 00000001.00000002.3282980444.00002E4400684000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://pcapp.store1chrome.exe, 00000001.00000002.3292498996.00002E4400EE9000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287938694.00002E4400A7C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://pcapp.store/chrome.exe, 00000001.00000002.3307073662.00002E4401DCC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3283599478.00002E440071A000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3304264888.00002E4401AA4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3276442437.00002E44002B4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3306568940.00002E4401C4C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3297226362.00002E44011DA000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3177907218.0000022A08FB7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3295757568.00002E44010E4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3205172270.0000022A09483000.00000002.00000001.00040000.0000001D.sdmp, chrome.exe, 00000001.00000002.3286297202.00002E440091C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3298626953.00002E4401374000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3274274008.00002E4400184000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3302550833.00002E44018E8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3291132244.00002E4400CF4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3281859803.00002E4400588000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3041396832.00000035A8DFC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3297226362.00002E44011D5000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3289459194.00002E4400BD4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3303775921.00002E4401A29000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3294418213.00002E4401040000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://doubleclick.net/dchrome.exe, 00000001.00000002.3289968594.00002E4400C34000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://duckduckgo.com/favicon.icochrome.exe, 00000001.00000002.3289364045.00002E4400BC0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionschrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacychrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0chrome.exe, 00000001.00000002.3283532479.00002E4400704000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pchrome.exe, 00000001.00000002.3279757116.00002E440049C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820411&cv_id=0&format=$chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        http://anglebug.com/3078chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                        • URL Reputation: safe
                                                                                                                        		unknown
                                                                                                                        https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3.Dchrome.exe, 00000001.00000002.3300849110.00002E44015BC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          http://anglebug.com/5375chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          		unknown
                                                                                                                          http://dl.google.com/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckhobaglnchrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://pcapp.storeHXchrome.exe, 00000001.00000002.3285222135.00002E440082C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3274347534.00002E4400194000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287217726.00002E44009EC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820429&cv_id=0&format=$chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3299577954.00002E4401464000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                http://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pachrome.exe, 00000001.00000002.3279757116.00002E440049C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  http://anglebug.com/5371chrome.exe, 00000001.00000002.3279662738.00002E4400470000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  		unknown
                                                                                                                                  http://anglebug.com/4722chrome.exe, 00000001.00000002.3289670910.00002E4400BEC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  		unknown
                                                                                                                                  https://m.google.com/devicemanagement/data/apichrome.exe, 00000001.00000002.3275857274.00002E440020C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  		unknown
                                                                                                                                  https://pcapp.store/.DvFwww.chrome.exe, 00000001.00000002.3284290360.00002E4400764000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://docs.google.com/presentation/u/0/create?usp=chrome_actionschrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://dl.google.com/release2/chrome_component/acisphmku46ptpbe4irtwh7guyza_9269/hfnkpimlhhgieaddgfchrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://www.google.com/pagead/1p-user-list/858128210/?random=1730700452912&cv=11&fst=1730700000000&bchrome.exe, 00000001.00000002.3295371176.00002E44010BC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://googletagmanager.com/cychrome.exe, 00000001.00000002.3298706212.00002E4401388000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820450&cv_id=0&format=$chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258&cr_id=682239234212&cv_id=0&format=$chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://chromewebstore.google.com/chrome.exe, 00000001.00000002.3266601040.00002E440000C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                		unknown
                                                                                                                                                https://pcapp.storeHchrome.exe, 00000001.00000002.3308227519.00002E440218C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3304612329.00002E4401AEC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3217065137.0000022A09607000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3266797386.00002E4400058000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3287414017.00002E4400A1C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3272102411.00002E44000DC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://pcapp.storeDate:chrome.exe, 00000001.00000002.3308227519.00002E440218C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://dl.google.com/release2/chrome_component/b3n6bzc5iojg34kogsjitu53ou_20241024.690425616.14/obechrome.exe, 00000001.00000002.3284214741.00002E440074C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://pcapp.store/pixelgif.phpderValidatorchrome.exe, 00000001.00000002.3302844687.00002E4401918000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_minSetup.exe, 00000000.00000002.1959860535.0000000000795000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://clients4.google.com/chrome-syncchrome.exe, 00000001.00000002.3274798506.00002E44001C4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=ersion=fa.1092cHSetup.exe, 00000000.00000003.1958885351.0000000002C2B000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1959307385.0000000002C2D000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.1960683749.0000000002C2E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688766820414&cv_id=0&format=$chrome.exe, 00000001.00000002.3302379498.00002E44018B8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppchrome.exe, 00000001.00000002.3272444618.00002E4400128000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown

                                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                                  Public IPs

                                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                  64.176.203.93
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		11022ALABANZA-BALTUSfalse
                                                                                                                                                                  142.250.185.206
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  142.250.186.170
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  142.250.74.206
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  142.250.186.174
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  52.222.169.28
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                  142.250.185.168
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  159.223.126.41
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		46118CELANESE-USfalse
                                                                                                                                                                  142.250.185.100
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  216.58.206.36
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  142.250.181.232
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  142.251.168.84
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  66.102.1.154
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  147.182.211.77
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		27555BV-PUBLIC-ASNUSfalse
                                                                                                                                                                  142.250.184.227
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  172.217.18.110
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  142.250.186.98
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  142.250.184.195
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  142.250.185.67
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  1.1.1.1
                                                                                                                                                                  		unknownAustralia
                                                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                                                  142.250.185.68
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  167.99.235.203
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		14061DIGITALOCEAN-ASNUSfalse
                                                                                                                                                                  212.102.56.179
                                                                                                                                                                  		unknownItaly
                                                                                                                                                                  		60068CDN77GBfalse
                                                                                                                                                                  239.255.255.250
                                                                                                                                                                  		unknownReserved
                                                                                                                                                                  		unknownunknownfalse
                                                                                                                                                                  207.211.211.27
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		14135NAVISITE-EAST-2USfalse
                                                                                                                                                                  172.217.16.194
                                                                                                                                                                  		unknownUnited States
                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                  37.19.194.81
                                                                                                                                                                  		unknownUkraine
                                                                                                                                                                  		31343INTERTELECOMUAfalse

                                                                                                                                                                  Private

                                                                                                                                                                  IP
                                                                                                                                                                  192.168.2.4

                                                                                                                                                                  General Information

                                                                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                  Analysis ID:1548201
                                                                                                                                                                  Start date and time:2024-11-04 07:06:30 +01:00
                                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                                  Overall analysis duration:0h 11m 4s
                                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                                  Report type:full
                                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                  Number of analysed new started processes analysed:15
                                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                                  Number of injected processes analysed:30
                                                                                                                                                                  Technologies:
                                                                                                                                                                  • HCA enabled
                                                                                                                                                                  • EGA enabled
                                                                                                                                                                  • AMSI enabled
                                                                                                                                                                  Analysis Mode:default
                                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                                  Sample name:Setup.exe
                                                                                                                                                                  Detection:MAL
                                                                                                                                                                  Classification:mal51.spyw.evad.winEXE@34/291@0/28
                                                                                                                                                                  EGA Information:
                                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                                  HCA Information:
                                                                                                                                                                  • Successful, ratio: 75%
                                                                                                                                                                  • Number of executed functions: 193
                                                                                                                                                                  • Number of non-executed functions: 142
                                                                                                                                                                  Cookbook Comments:
                                                                                                                                                                  • Found application associated with file extension: .exe

                                                                                                                                                                  Warnings

                                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                  • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                  • Skipping network analysis since amount of network traffic is too extensive

                                                                                                                                                                  Simulations

                                                                                                                                                                  Behavior and APIs

                                                                                                                                                                  TimeTypeDescription
                                                                                                                                                                  01:08:24API Interceptor470x Sleep call for process: Watchdog.exe modified
                                                                                                                                                                  01:08:25API Interceptor236x Sleep call for process: explorer.exe modified
                                                                                                                                                                  01:08:53API Interceptor1x Sleep call for process: PcAppStore.exe modified
                                                                                                                                                                  06:08:25AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                  06:08:33AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
                                                                                                                                                                  06:08:42AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241104010824.6836367156 /ver=fa.1092c
                                                                                                                                                                  06:08:50AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                  06:08:59AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
                                                                                                                                                                  06:09:07AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241104010824.6836367156 /ver=fa.1092c

                                                                                                                                                                  LLM Input / Output

                                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                                  IPs

                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                  64.176.203.93Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                      1.1.1.1PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                                                                                                                                      • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                                                                                                                                      AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                      • 1.1.1.1/
                                                                                                                                                                      INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                      • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                                                                                                                                      Go.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                      • 1.1.1.1/
                                                                                                                                                                      147.182.211.77Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                        Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                              159.223.126.41https://pcapp.store/pixel.gifGet hashmaliciousUnknownBrowse
                                                                                                                                                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    tKr6T60C1r.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      MDE_File_Sample_ba40401128d2ff2734a7e554120b7de438870654.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                        https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwj85-Cx0Pz-AhV5FVkFHezeDZcQFnoECCUQAQ&url=https%3A%2F%2Fwww.dltk-teach.com%2Frhymes%2Fmacdonald%2Fmlyrics.htm&usg=AOvVaw0mYQOAG6hFsIBU_fVcAryoGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          167.99.235.203https://pcapp.store/pixel.gifGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              Setup (1).exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                MDE_File_Sample_c30dd28cb119f2aa20ddabe8968b8cadbe80bcb2.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  nso7806.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    http://classicshell.mediafire.com/file/d5llbbm8wu92jg8/ClassicShellSetup_4_3_1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      MDE_File_Sample_ba40401128d2ff2734a7e554120b7de438870654.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        PcAppStore.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                          Domains

                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                          ASNs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          CELANESE-UShttps://hotmail.cdisaomiguel.com.brGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 159.223.72.100
                                                                                                                                                                                                          https://pcapp.store/pixel.gifGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 159.223.126.41
                                                                                                                                                                                                          original.emlGet hashmaliciousMamba2FABrowse
                                                                                                                                                                                                          • 159.223.72.100
                                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 159.223.126.41
                                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 159.223.126.41
                                                                                                                                                                                                          K3Kvd8JYGV.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 159.223.211.130
                                                                                                                                                                                                          https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 159.223.103.226
                                                                                                                                                                                                          https://netorgft4648155-my.sharepoint.com/:f:/g/personal/cgriffith_nationsbest_net/ErhP9j6s6O5LtAYvSf-k7fgBJJeB0TUcEyK1gf2JqcFeEw?e=iS1Nd2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 159.223.103.226
                                                                                                                                                                                                          7ffbfc130000.conhost2.dll.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 159.223.46.184
                                                                                                                                                                                                          7ffbfc130000.conhost2.dll.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 159.223.46.184
                                                                                                                                                                                                          ALABANZA-BALTUSGkyZlYczv9.dllGet hashmaliciousBumbleBeeBrowse
                                                                                                                                                                                                          • 65.108.214.195
                                                                                                                                                                                                          IP0XYLm4Uv.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                          • 65.109.243.0
                                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 64.176.203.93
                                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 64.176.203.93
                                                                                                                                                                                                          0T32Kz4dZU.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                          • 65.108.249.83
                                                                                                                                                                                                          NlpWS1Iq5Z.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                          • 65.108.249.83
                                                                                                                                                                                                          http://ddl.safone.devGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 65.108.207.55
                                                                                                                                                                                                          yt5xqAvHnZ.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                          • 65.109.243.0
                                                                                                                                                                                                          la.bot.sh4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 65.109.195.245
                                                                                                                                                                                                          byte.mips.elfGet hashmaliciousOkiruBrowse
                                                                                                                                                                                                          • 65.108.253.200
                                                                                                                                                                                                          AMAZON-02USsegura.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                          • 185.166.143.48
                                                                                                                                                                                                          MV Sunshine.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          https://eu-central-1.protection.sophos.com/?d=sharepoint.com&u=aHR0cHM6Ly9uZXRvcmc1NTI5NjcxLW15LnNoYXJlcG9pbnQuY29tLzp1Oi9nL3BlcnNvbmFsL2JrYXR6bWFuX2Jha2Nvbl9jYS9FY05hS3RrLXZuNUxzRUREN3ZGT2tLd0Jyd2lPd2sxRUt2WjFIeEZzY19IbExRP2U9Z3NzdVR1&p=m&i=NWNiN2ZlZTg4MWQzYmMxNDQ2YTllNGIz&t=ZlRrdEtuVnlvSnRrRmpiWkdaa0QzUnJKUkZtT05pdmhFSTRnQi9rMnhuZz0=&h=0dfd0e65e0964d34b38aeba6b2a34689&s=AVNPUEhUT0NFTkNSWVBUSVYygINiVNhfZZgtuoRvmxtnIfDHW8XVBEMJ-Rud22NUlMhqF-vLa95XzSmpA0zQuH8Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 3.161.82.108
                                                                                                                                                                                                          nuklear.arm5.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 54.171.230.55
                                                                                                                                                                                                          nuklear.arm6.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                          • 54.171.230.55
                                                                                                                                                                                                          nuklear.arm.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                          • 44.226.204.227
                                                                                                                                                                                                          file.exeGet hashmaliciousAmadey, Credential Flusher, Stealc, Vidar, XmrigBrowse
                                                                                                                                                                                                          • 34.212.129.198
                                                                                                                                                                                                          mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 18.221.112.112
                                                                                                                                                                                                          arm4.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                          • 18.253.84.24
                                                                                                                                                                                                          nuklear.x86.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                                                                                                                                          • 34.249.145.219
                                                                                                                                                                                                          BV-PUBLIC-ASNUSSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 147.182.211.77
                                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 147.182.211.77
                                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 147.182.211.77
                                                                                                                                                                                                          Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 147.182.211.77
                                                                                                                                                                                                          la.bot.sh4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 147.182.236.130
                                                                                                                                                                                                          armv4l.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 147.183.0.9
                                                                                                                                                                                                          1.exeGet hashmaliciousMetasploitBrowse
                                                                                                                                                                                                          • 147.182.192.25
                                                                                                                                                                                                          5.exeGet hashmaliciousMetasploitBrowse
                                                                                                                                                                                                          • 147.182.192.25
                                                                                                                                                                                                          https://sucursal-virtual03.w3spaces.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 147.182.129.240
                                                                                                                                                                                                          https://www.google.com/url?q=https://www.google.com/url?q%3DdCSMjVnvsqsqaP8pEWWm%26rct%3DSpPq9HncUaCXUtCZusX0%26sa%3Dt%26esrc%3DuZR6jk9A67Rj7RZhLuPE%26source%3D%26cd%3Deh0xIKCKpKh7i4kTt26p%26cad%3DVEVtMkQKVNr1KW4fxShi%26ved%3DNTDACygNXetEDbRT8YiY%26uact%3D%2520%26url%3Damp%252F%E2%80%8Breid%C2%ADopur%C2%ADificador%E2%80%8B.%E2%80%8Bc%C2%ADom.b%C2%ADr//////xone1/yzrog/c3R1YXJ0Lm1hcnN0b25Ac2VhYm9hcmRtYXJpbmUuY29t$%C3%A3%E2%82%AC%E2%80%9AGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 147.182.205.62

                                                                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                          Dropped Files

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsa4E4E.tmphttps://pcapp.store/pixel.gifGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsk2875.tmp\NSISFastLib.dllSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    https://pcapp.store/pixel.gifGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        Setup.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002d.db

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106768
                                                                                                                                                                                                                          Entropy (8bit):4.02237024691125
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:1s7Fk3r1kDGsHhX9jk0Yct63CXBwNXLF/aJIYXxkxvRCR1vcdPk8dRmRypE3oXBL:1LknHHtImBNubhBiQG9n1aFjKGWGx
                                                                                                                                                                                                                          MD5:F39EB28B84C4B22655A17C6CE28BCFAB
                                                                                                                                                                                                                          SHA1:A5F49652F7E0AD505325453C5CA5A3D52E5A221B
                                                                                                                                                                                                                          SHA-256:9BB01B6BC3AACEA132C94D3F9BFCACBA2F9635BC40299F0DD1614036545A47FD
                                                                                                                                                                                                                          SHA-512:709C3DAA11E3E5DD732BA557A0B4807F64C785882A9F055A9CBE67C68550DA8AA91F7F390D5A77E11BB1A1C12DA9C682C581C1FF9F104D76331A1301BB14CF31
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:....h... ...............P...............Z...(..._...h...................X.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[10].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[1].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[2].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[3].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[4].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[5].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[6].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[7].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[8].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[9].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[10].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[1].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[2].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[3].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[4].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[6].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[7].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[8].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[9].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[10].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[1].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[2].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[3].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[4].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[5].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[6].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[7].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[8].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[10].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[1].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[2].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[3].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[4].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[5].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[6].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[7].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[8].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[9].gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):93386616
                                                                                                                                                                                                                          Entropy (8bit):7.99999306217129
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:1572864:52KX1mfH5AoIZnp9/pkhKzHjrSADzxet6X3mRsDqpszbyxjpB3ayh1sN1KGoMy1u:5jExAJh/pksTnFet6mu2G0jptggJ+flP
                                                                                                                                                                                                                          MD5:84EE733F8014D22DAD2DFEF725489980
                                                                                                                                                                                                                          SHA1:950A437488464103B9BF34610962C22192585BFC
                                                                                                                                                                                                                          SHA-256:F42D2BF4A50AB0CDB4A1C43964F0429C4663E27C76D8C61AFA174A531A7819A1
                                                                                                                                                                                                                          SHA-512:132C9BE1217804B73F8A99EA44D702E9DA0782CB6BBCC80DB2C2C72BDA1A93D06B2ADEF1B464F9163311F7482B2400553BA082C0F7F3CCF3B42C8C9B881306EB
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 42%
                                                                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                                                                          • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ............@.............................................HO.......... ..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsk2875.tmp\NSISFastLib.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):140288
                                                                                                                                                                                                                          Entropy (8bit):6.334087823000165
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
                                                                                                                                                                                                                          MD5:9C7A4D75F08D40AD6F5250DF6739C1B8
                                                                                                                                                                                                                          SHA1:793749511C61B00A793D0AEA487E366256DD1B95
                                                                                                                                                                                                                          SHA-256:6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
                                                                                                                                                                                                                          SHA-512:E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: Setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsk2875.tmp\System.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):5.814115788739565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
                                                                                                                                                                                                                          MD5:CFF85C549D536F651D4FB8387F1976F2
                                                                                                                                                                                                                          SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                                                                                                                                                                                                          SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                                                                                                                                                                                                          SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsk2875.tmp\image.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):997
                                                                                                                                                                                                                          Entropy (8bit):4.188896534234179
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
                                                                                                                                                                                                                          MD5:1636218C14C357455B5C872982E2A047
                                                                                                                                                                                                                          SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                                                                                                                                                                                                                          SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                                                                                                                                                                                                                          SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsk2875.tmp\inetc.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):39424
                                                                                                                                                                                                                          Entropy (8bit):4.684597989866362
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
                                                                                                                                                                                                                          MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                                                                                                                                                                                                                          SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                                                                                                                                                                                                                          SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                                                                                                                                                                                                                          SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsk2875.tmp\modern-wizard.bmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                          File Type:PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26494
                                                                                                                                                                                                                          Entropy (8bit):1.9568109962493656
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
                                                                                                                                                                                                                          MD5:CBE40FD2B1EC96DAEDC65DA172D90022
                                                                                                                                                                                                                          SHA1:366C216220AA4329DFF6C485FD0E9B0F4F0A7944
                                                                                                                                                                                                                          SHA-256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
                                                                                                                                                                                                                          SHA-512:62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsk2875.tmp\nsDialogs.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9728
                                                                                                                                                                                                                          Entropy (8bit):5.158136237602734
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
                                                                                                                                                                                                                          MD5:6C3F8C94D0727894D706940A8A980543
                                                                                                                                                                                                                          SHA1:0D1BCAD901BE377F38D579AAFC0C41C0EF8DCEFD
                                                                                                                                                                                                                          SHA-256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
                                                                                                                                                                                                                          SHA-512:2094F0E4BB7C806A5FF27F83A1D572A5512D979EEFDA3345BAFF27D2C89E828F68466D08C3CA250DA11B01FC0407A21743037C25E94FBE688566DD7DEAEBD355
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....Oa...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsk2875.tmp\nsJSON.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24064
                                                                                                                                                                                                                          Entropy (8bit):5.819708895488079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
                                                                                                                                                                                                                          MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                                                                                                                                                                                                                          SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                                                                                                                                                                                                                          SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                                                                                                                                                                                                                          SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsq9CF9.tmp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):318525781
                                                                                                                                                                                                                          Entropy (8bit):6.931313706371873
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3145728:EEnqgvUBRlhK9QJiDS610scieJq1SXCSnsmdAGonTn:EEIKe0Djq7hCSkH
                                                                                                                                                                                                                          MD5:1E82AC21A0AB4FB084013AC7F54B3647
                                                                                                                                                                                                                          SHA1:152308A3F71C6CB7EADC4A6ECE3991E679CFC92F
                                                                                                                                                                                                                          SHA-256:6A776340A1B9EC3E8094D3B46C247A3144F882D57AD976E6467407B8E09C3204
                                                                                                                                                                                                                          SHA-512:A2F2C3C83F2FA83EEDBC3D70BF60E7DD16794B7DACD41FF2DA225034349ED2FDA070BA12F4E5E880A5B5FD81FA58B9C115B9A5812728575750704647654FDE89
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.7......,.......,.......D...=...........^6......\7..............................................................m...........................................................................................................................................................................3................2..................................................................................................................................j.......................k...................................................................................................................s..........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\Math.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):69120
                                                                                                                                                                                                                          Entropy (8bit):6.024967061017882
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:GUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2tS:T97WSth5lwt
                                                                                                                                                                                                                          MD5:85428CF1F140E5023F4C9D179B704702
                                                                                                                                                                                                                          SHA1:1B51213DDBAEDFFFB7E7F098F172F1D4E5C9EFBA
                                                                                                                                                                                                                          SHA-256:8D9A23DD2004B68C0D2E64E6C6AD330D0C648BFFE2B9F619A1E9760EF978207A
                                                                                                                                                                                                                          SHA-512:DFE7F9F3030485CAF30EC631424120030C3985DF778993342A371BF1724FA84AA885B4E466C6F6B356D99CC24E564B9C702C7BCDD33052172E0794C2FDECCE59
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.................F.........................5.....5....:6....Rich...........PE..L.....Oa...........!................KG....................................................@.............................B.......(....................................................................................................................text...b........................... ..`.rdata..R...........................@..@.data............2..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\NSISFastLib.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):140288
                                                                                                                                                                                                                          Entropy (8bit):6.334087823000165
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
                                                                                                                                                                                                                          MD5:9C7A4D75F08D40AD6F5250DF6739C1B8
                                                                                                                                                                                                                          SHA1:793749511C61B00A793D0AEA487E366256DD1B95
                                                                                                                                                                                                                          SHA-256:6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
                                                                                                                                                                                                                          SHA-512:E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\System.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):5.814115788739565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
                                                                                                                                                                                                                          MD5:CFF85C549D536F651D4FB8387F1976F2
                                                                                                                                                                                                                          SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                                                                                                                                                                                                          SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                                                                                                                                                                                                          SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\image.gif

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):997
                                                                                                                                                                                                                          Entropy (8bit):4.188896534234179
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
                                                                                                                                                                                                                          MD5:1636218C14C357455B5C872982E2A047
                                                                                                                                                                                                                          SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                                                                                                                                                                                                                          SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                                                                                                                                                                                                                          SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\inetc.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):39424
                                                                                                                                                                                                                          Entropy (8bit):4.684597989866362
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
                                                                                                                                                                                                                          MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                                                                                                                                                                                                                          SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                                                                                                                                                                                                                          SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                                                                                                                                                                                                                          SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\nsJSON.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24064
                                                                                                                                                                                                                          Entropy (8bit):5.819708895488079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
                                                                                                                                                                                                                          MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                                                                                                                                                                                                                          SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                                                                                                                                                                                                                          SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                                                                                                                                                                                                                          SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\temp

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):42
                                                                                                                                                                                                                          Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                          MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                          SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                          SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                          SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Fri Oct 25 14:14:38 2024, mtime=Mon Nov 4 05:08:24 2024, atime=Fri Oct 25 14:14:38 2024, length=3116888, window=hide
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1857
                                                                                                                                                                                                                          Entropy (8bit):3.481964088512328
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8Aw21Ppc/kp8yAhN6RknwtkkyHiO/7mkMnqyFm:8AZPpokyRHkknOyHiGyF
                                                                                                                                                                                                                          MD5:C57590A91E862ECE1BE3F11AACF3F548
                                                                                                                                                                                                                          SHA1:75E566E133B2B0AF11DE4967888D850037A3EEDC
                                                                                                                                                                                                                          SHA-256:6FCC1437922423C716915FE628F19FF551A72C1DE6460649D2200F8430259FD6
                                                                                                                                                                                                                          SHA-512:7556EA96AC086F66BB24CE7320A5BBA52C06792F5200C7FF425DCEB78D1E2E94A08F32BCA79A7C91E0EEB4389791A289C41A7978D1AEF514621F0CF7A16ECAB7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:L..................F.@.. .....y..&............y..&..X./.....................0.:..DG..Yr?.D..U..k0.&...&......vk.v.......................t...CFSF..1.....dY.1..PCAPPS~1....t.Y^...H.g.3..(.....gVA.G..k...F......dY.0dY.1....V......................,&.P.C.A.p.p.S.t.o.r.e...D.j.2.X./.YY.y .PCAPPS~1.EXE..N......YY.ydY.1....7.........................P.c.A.p.p.S.t.o.r.e...e.x.e.......W...............-.......V.............3......C:\Users\user\PCAppStore\PcAppStore.exe..+.....\.....\.....\.....\.....\.....\.P.C.A.p.p.S.t.o.r.e.\.P.c.A.p.p.S.t.o.r.e...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.P.C.A.p.p.S.t.o.r.e.../.i.n.i.t. .d.e.f.a.u.l.t. .s.h.o.w.M.(.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.P.C.A.p.p.S.t.o.r.e.\.p.c.a.p.p.s.t.o.r.e...i.c.o.........%USERPROFILE%\PCAppStore\pcappstore.ico.............................................................................................................................................................................................................................%

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\AutoUpdater.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):586584
                                                                                                                                                                                                                          Entropy (8bit):6.337989770444409
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:BYnWgtbxN7L7kYcMB/cA4hxWbZKcXErHNkQLtZ9wNmCc0r93SFzd7FSAaxXDj5w:BYnWC7sQB/cA4nLrtkWemCn9YBUxXXy
                                                                                                                                                                                                                          MD5:693221C78FDC00A0F87FB3D1381308D4
                                                                                                                                                                                                                          SHA1:5ABD1481B0918A1815B542BFCB2EAD542C233DB8
                                                                                                                                                                                                                          SHA-256:6BB4786AB76767D1F9B2E19FD1A20F2F76CF1BB96127FC26741F2BE609E7680D
                                                                                                                                                                                                                          SHA-512:A58F0A1EA54ED94EDF3129088D89F2064F7D93ECD30F9590307963B287C8FF45580DC4D9A48F6D6C4AF72DB6E1E82EEF0EA3E4BF756B93B159C3CDE808041CFD
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................f....f....f...............g.....gH.... ....g....Rich...........PE..d......g.........."....).....V.................@.....................................x....`.................................................P............G...P..PR......X)..........P...T.......................(.......@............................................text............................... ..`.rdata...m.......n..................@..@.data....<....... ..................@....pdata..PR...P...T... ..............@..@.rsrc....G.......H...t..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\PcAppStore.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3116888
                                                                                                                                                                                                                          Entropy (8bit):5.959240683924359
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:V9kabuTUmENsEyg1IgoPYbvE8C9BHv3QJTbiNG8g9MEiYQgsSryyH2mtJXKMCSd+:V5bGEXi8mPY9pMFxu7cnZN3
                                                                                                                                                                                                                          MD5:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                                                          SHA1:0980A7B75DB94035A5DE1696210648ACB95ACEDE
                                                                                                                                                                                                                          SHA-256:D4DE255AE1109391E4A4A967A8AD66DFB70FCCA7DB47777E40815F4E7B19F2A2
                                                                                                                                                                                                                          SHA-512:0F87422498ED3C60ED21CDA492D038D10509E3B40E5E9D7614B6CB0EF903E241AD1BA9C2F67B43D9DA3980990735A5E0C325002E43E0A41CB12947E2DBECF19F
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l4 O.ZsO.ZsO.Zs.uYrG.Zs.u_r..Zs_.^r\.ZsFu.sM.Zs_.YrC.Zs_._r$.Zs.u^rX.Zs.u\rN.Zs.u[rf.ZsO.[s..Zs..^rM.Zs.._r~.Zs...sN.ZsO..sN.Zs..XrN.ZsRichO.Zs........PE..d......g.........."....)..&..........+"........@.............................P0....../...`...................................................*......./.P^....-......f/.X)... 0..&..0").p....................$).(.... ).@.............&.H............................text.....&.......&................. ..`.rdata...`....&..b....&.............@..@.data...H.... +.......+.............@....pdata........-.......,.............@..@.rsrc...P^..../..`..................@..@.reloc...&... 0..(...>/.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ReadMe.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):4.577360416859904
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:TKPyFfliFRNAl2sIaRjyM1KOTxLELMZ4MKLJF8EelYq8AsXJVVWM4v:TyyFflmSssI+j1NLELM6MKn8EquZVVCv
                                                                                                                                                                                                                          MD5:2845450EA9D938CFEA9809CA0C827F12
                                                                                                                                                                                                                          SHA1:8DE2189530DA5923365436C37E4C55C500AC3FBF
                                                                                                                                                                                                                          SHA-256:7FDADB3CA5B81C6D1C58A20610921BF89D63DC65B77BE982F422C6FD2A13F166
                                                                                                                                                                                                                          SHA-512:7D19FE6E9DD51BB880FD6FBB7EE126C8078771EE5166D53F312B04D117CE2897CBB6DFB5E5627314C3CF8B56F7A2BBF5B9D38258E7912B0AC5D420B611B7C363
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Fhis folder contains the PC App Store for Microsoft Windows.....For additional information, please visit https://pcapp.store/?p=lpd_appstore-faq..

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\Temp\tempPOSTData

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2258
                                                                                                                                                                                                                          Entropy (8bit):5.169643658295399
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:YZ1HdtyDF9hw3ZMqr8ZPfOqfYLkGYOOzfhrxEty6WHvQ876yFmgkM92dmOvbV9:oNdAOpMtZPPALkOOzVxqy6WHvQ87lFmX
                                                                                                                                                                                                                          MD5:60ABC714F744EB6633D13B0E26194721
                                                                                                                                                                                                                          SHA1:63268E43FCEE663E31CA1AAE8E090CBCBDCB954D
                                                                                                                                                                                                                          SHA-256:B0852BC3320B6F4B5C0D10981299890C5294C5D94269FF89D79C2D96032C6C60
                                                                                                                                                                                                                          SHA-512:579E776D7A3B6A16FB79CD50B1C24E7410727CC1C240A33D2CE417E147A27B5BDAA1EBAE08E8CC10A50898E93E25ED73F88F36CFFF15152F9081CFBFBF75153E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"3X_5W6K","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"E8_29GWO+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Ad

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\Temp\tempPOSTResponse

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):73
                                                                                                                                                                                                                          Entropy (8bit):4.089026662492467
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:YGVE8fptxgDQLRv6zjQJNRvUXZ5:YGFRt9IoNaZ5
                                                                                                                                                                                                                          MD5:3024A54E0C352ABE5EB5F753CA4828DA
                                                                                                                                                                                                                          SHA1:DF0206851654405C8E5C2D3BC96FB536B8C2DCBF
                                                                                                                                                                                                                          SHA-256:3CD0A703506C7394D6115D9FF721516560894358AEF07459F30D8930DF6C3B61
                                                                                                                                                                                                                          SHA-512:D9D44051DF56B29AA596EE38463B781DBE27F917F7DAE1B2420122616DA108520429DDA58C75C7E6B2D41093F83C5A4BAE96024885AF3956F23A3CE5BD3F9358
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"cpg":"default","inst_excl":null,"inst_addon":null,"inst_advanced":null}

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\Uninstaller.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):93880
                                                                                                                                                                                                                          Entropy (8bit):6.891280387415397
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:2msAYBdTU9fEAIS2PEtu3rLFn22G9RowU49TV1Z43kUFInU73ALu:FfY/TU9fE9PEtubZrMtkkxUUi
                                                                                                                                                                                                                          MD5:CD8B6F1BD281C288FB3F68925639B424
                                                                                                                                                                                                                          SHA1:25EA108C45905418B8FDA2FCCF5ADA0EDE2710E5
                                                                                                                                                                                                                          SHA-256:808FE10CBF09F21359E1D61860BFCDDE553F5CDA38723ECD0636FA25F652121D
                                                                                                                                                                                                                          SHA-512:A05C60EA499BEA246FF0CB3308108862CDC56BC44A4E14F546FE8AF4C52172F73F5973EBA03FF1F2BB1C575C15BF62421034C02AFA703D093B986F95A999E1B6
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 29%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ......f.....@.............................................HO..........`E..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\Watchdog.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):276312
                                                                                                                                                                                                                          Entropy (8bit):6.155274238783893
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:JNh5y0IKTcOq1wpRsrIA/uuNT4KddgLA/exq10mMfnW9L/or6RMr4T+cnOMX4Hen:jyJKA5KKdWLA/GZhnWlV94+3H3
                                                                                                                                                                                                                          MD5:11F3801CB9FF046D6075F681971C4EB8
                                                                                                                                                                                                                          SHA1:91572872A265185E7F9793B50C5257B511707B36
                                                                                                                                                                                                                          SHA-256:5BD22345C42FC1B7C89C281C9247BC81DBBDB4C8EF4DA76E2A9D86589D8CC118
                                                                                                                                                                                                                          SHA-512:B7E1A5F391E112AAC0CFA8239AD5AE784161C8734C9A4F3EF386FF617915F7AC769A5DB790B66BD95E6DAB8BAABCC4E51DE31D614193CB69909DF393DC77A021
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P........................H............Q.......Q.......Q..................t....P.......P&.......N......P......Rich............................PE..d......g.........."....).............,.........@.............................p...........`.....................................................x........G.......1......X)...`.......O..p....................Q..(...PN..@............................................text............................... ..`.rdata..............................@..@.data....%...........|..............@....pdata...1.......2..................@..@.rsrc....G.......H..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\NW_store.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2312704
                                                                                                                                                                                                                          Entropy (8bit):6.449649685576397
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:gg6wrmvfu6ZPfRFq8BcvDEzT3CuaMUgKS:H8Zn3Ci
                                                                                                                                                                                                                          MD5:E472E46BDFD736351D4B086B4C4CA134
                                                                                                                                                                                                                          SHA1:1AA886F0CB23B3D322A43BE797D411FCA84D82A7
                                                                                                                                                                                                                          SHA-256:E825A252B5C5C9C2DE8A6A6ADE12A7F9CD0040F6A20E6EE44BA659034E6D5223
                                                                                                                                                                                                                          SHA-512:173F5A7ABDFEA01C9C21EC716CBA14EEC4539DA45E5734B3FD1E0688E1C22E4718BD701C25C8040D20CF48867E2A67EF2ABA46380BAB9AB1F7A42BD66FD33AFB
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."..........R.......R.........@.............................0$...........`.........................................',.......,..d....0........................$.@!..l...8...................@...(.......8............4..........`....................text...X........................... ..`.rdata..............................@..@.data............F..................@....pdata..............................@..@.gxfg...P........0..................@..@.retplne.............N...................tls.................P..............@....voltbl.D............T..................CPADinfo8............V..............@..._RDATA...............X..............@..@malloc_h0.... .......Z.............. ..`.rsrc........0.......\..............@..@.reloc..@!....$.."...(#.............@..B................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\credits.html

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9560433
                                                                                                                                                                                                                          Entropy (8bit):4.8475056659478915
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:/28lTEaiPJK0PJgVEv+F26vbV2f2EvYvAKMc/+uBPJ1PJLPJ1PJOPJDKspVosXxY:/2ETWgqSq+sIp2+qO1McdLRPiY2zXO
                                                                                                                                                                                                                          MD5:7A32B7C762C76BD3EE38E3E998705899
                                                                                                                                                                                                                          SHA1:E1C611A57115374A48CD84619BD06E43021B7352
                                                                                                                                                                                                                          SHA-256:726276A62DB14DD751F32B77200E90A8000712BD256ED038BEA928C6AEF0C892
                                                                                                                                                                                                                          SHA-512:9FE66FE4479915B0EFE12ADFB386BA251B2C2AF8CCD92B4D67F61C9D2AE537C6D3512E4379AFF10EAB3CD433FC1EDEC702E63DDFE4F83769A746FF249288D4DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview: Generated by licenses.py; do not edit. --><!doctype html>..<html>..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width">..<meta name="color-scheme" content="light dark">..<title>Credits</title>..<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">..<link rel="stylesheet" href="chrome://credits/credits.css">..</head>..<body>..<span class="page-title">Credits</span>..<a id="print-link" href="#" hidden>Print</a>..<label class="show show-all" tabindex="0">..<input type="checkbox" hidden>..</label>..<div class="open-sourced">.. Chromium software is made available as source code.. <a href="https://source.chromium.org/chromium">here</a>...</div>....<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->..<div class="product">..<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>..<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">h

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4916712
                                                                                                                                                                                                                          Entropy (8bit):6.398049523846958
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                                                          MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                                                          SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                                                          SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                                                          SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\ffmpeg.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2028032
                                                                                                                                                                                                                          Entropy (8bit):6.64708834859118
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:x+QrVq8lxXjKAri3/8XLpvdZ4RAfdDY0K1w/cjWsdSJNTtMfxTCC:pdlNBfXt16RsFY0K3jWsdQVtM0C
                                                                                                                                                                                                                          MD5:5FFF6F0423A38BFAF174CB670650F4F9
                                                                                                                                                                                                                          SHA1:13ECD1C4784A5A178A998E9FC0DC08F556121712
                                                                                                                                                                                                                          SHA-256:D4E6FC4E1BC6CB5B3EF7010E61D3A65E97804FB20346CEE657688339075B2727
                                                                                                                                                                                                                          SHA-512:E6FF0EA9F6196470F6E094D0AB655FB527C28FC2B2A5D126A10C1F4185C0DFF5ED4F19E7ED717D67DF324562B7AA56ED87AA0BD396A6BA722D3141B9F30FC41B
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........D......0.........................................c...........`A.........................................T.......Z..(.....c.0.....b..|............c..2...<..8....................;..(....<..8...........8^..`............................text............................... ..`.rdata..\7.......8..................@..@.data....D......"..................@....pdata...|....b..~..................@..@.gxfg....,....c.....................@..@.retplne.....@c..........................tls.........Pc.....................@....voltbl.8....`c........................._RDATA.......pc.....................@..@.rsrc...0.....c.....................@..@.reloc...2....c..4..................@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\icudtl.dat

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10717392
                                                                                                                                                                                                                          Entropy (8bit):6.282534560973548
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
                                                                                                                                                                                                                          MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                                                                                                                                                                                                          SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                                                                                                                                                                                                          SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                                                                                                                                                                                                          SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\libEGL.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):454144
                                                                                                                                                                                                                          Entropy (8bit):6.3485070297294985
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:yLSe7mxAked1dLX9ValhL1IA9SbD/9PAE:yExAkedHLX9VC9OKE
                                                                                                                                                                                                                          MD5:7255FCCD39F330CA2123F380B4967E0A
                                                                                                                                                                                                                          SHA1:C8E0E1A3E129DF7AB8922F039FFDBBA20DFBA8E2
                                                                                                                                                                                                                          SHA-256:22C2E5452FB01513C331B9E88313830C96EB3E554FAB942AFCBD6FB8702DF730
                                                                                                                                                                                                                          SHA-512:ECD66B0A43AEFD2C4721CD574D2394A2A9069B5258E310A0FC16C3919FD2505BFE91DB2FF8E4B5C7EF0187C86B167004659D15943F5BE6DF42BBFC297FB42119
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................7....................................................`A........................................`...h.......(.......x........A..............(...L...8...................0...(....)..8............... ............................text...2........................... ..`.rdata...}.......~..................@..@.data....O...`... ...H..............@....pdata...A.......B...h..............@..@.gxfg...`%.......&..................@..@.retplne.....0...........................tls....!....@......................@....voltbl.8....P.........................._RDATA.......`......................@..@malloc_h0....p...................... ..`.rsrc...x...........................@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\libGLESv2.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8058880
                                                                                                                                                                                                                          Entropy (8bit):6.448026576223661
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:98304:XUoMnbHa6h5CmPt75W2+G15kI6a7Xm3rC:gDTCe4rt/aTCr
                                                                                                                                                                                                                          MD5:6CD8726BEEFCFA69B48EAB1362A5CAD5
                                                                                                                                                                                                                          SHA1:F4249179B86C0A870C55E6C5A263180C77017E81
                                                                                                                                                                                                                          SHA-256:2636DA528EDCAEC9834255A92411BD5DA921D793825D74CEB997E336A0DBD393
                                                                                                                                                                                                                          SHA-512:0F6600315B0E1B5371BB39290E5417EBAA0F3C7FB47EEF32D73AFCE299722A426DD244FD3775D88FCEB6F170F16B23B099244EE825F7F8185D58F1BF28583515
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......^...........Z.......................................{...........`A.........................................2r.......s.d.....z.......x.HX............{.|...$.q.8.....................q.(.....p.8.............s.....@1r.@....................text.....^.......^................. ..`.rdata..d....0^.......^.............@..@.data.........s.......s.............@....pdata..HX....x..Z...pw.............@..@.gxfg....,...pz.......y.............@..@.retplne......z.......y..................tls....Q.....z.......y.............@....voltbl.D.....z.......y................._RDATA........z.......y.............@..@malloc_h0.....z.......z............. ..`.rsrc.........z.......z.............@..@.reloc..|.....{.......z.............@..B........................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\af.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):502905
                                                                                                                                                                                                                          Entropy (8bit):5.409605383978337
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:Mqyim2uho5EnirXKhaG1B2+H2JynyaH4IFzZo0vgElgA2W0PSq+2ss30fzO75g6p:U2uhounkXyd1B2+H2JynyaH4IFzZo0ve
                                                                                                                                                                                                                          MD5:8032CB8A1B40AC85ACBEAFD6514BE668
                                                                                                                                                                                                                          SHA1:EE15C360BD913FFEC94E9E36224548CA83B2564C
                                                                                                                                                                                                                          SHA-256:1762EB36E254C02A50ED089ED737235FD7A64C0D234581612ACA56F6398CAC97
                                                                                                                                                                                                                          SHA-512:956241DA1EE60C648417C6BF3921554F1F19AB17163DBDA764AE0DC21E1729C9357BFB900B1F948D2C649F9D53DA7CEFF3128B8CFAB34FD03053A8C37C663F5D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z.................................................................Y.................&.......................).................H.....]...........#.....X.....q.................9.....G.......................*.......................4................./.....L.................:.....L.................6.....E.................T.....j...........R.......................G.....d.....u.................,.....9.............................I.......................?.......................%.....m.......................6.....].....f.................(.....1.................`.....w.................:.....R.......................5...............................................P.............................~.......................~...................................p.................] ..... ..... .....!.....!.....!.....!....."....Y"....}"....."....."....9#....d#

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\af.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\am.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):813426
                                                                                                                                                                                                                          Entropy (8bit):4.915984741122479
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:dTZog2ule8/xHT9KG3Sj+KRRz0l85X9icV03OzP+Xx30jH8+j:/ogg8/xpKGCj+KRRz085X9icV03OzP+W
                                                                                                                                                                                                                          MD5:7B88BD642C86EC4D4FB9A5614D1DA63F
                                                                                                                                                                                                                          SHA1:92CF23267B78039E2413F7F7F90E6636614A0C5C
                                                                                                                                                                                                                          SHA-256:0C1DE970426BA291B10CD08FF0E6B078ADF4C1D07B24E0D89D9322FD2EC2E296
                                                                                                                                                                                                                          SHA-512:17E2381491A8844D1AD6910C3876C817ADE5CF2DAD8461771BAE9E967F7F64954917E20F8258CE6548AF1C21F8CF7E9477C7BCDCE6DD216140BF4D32410A31D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........?&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................0.....O.....$.......................u.....-.......................i................................... .................\.....o...........h.................f...........7.....g.....J...........\........... .............................\.............................r...........l.....+.................Z.......................z...........".....5.................B.....U.......................?...........o ..... ..... ....r!.....!....Q"....g".....".....#.....#.....#....l$.....$....6%....F%.....%.....&...."'....H'.....'....;(....u(.....(....!).....).....).....).....*.....*....C+....\+.....,.....,.....,....E-.....-....'.....`............/...../...../.....0.....0....A1.....1.....1.....2....`3.....3.....4.....4....y5.....5.... 6.....6.....7.....7.... 8.....8.....8.....9.....9.....9....p:.....:

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\am.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):822020
                                                                                                                                                                                                                          Entropy (8bit):4.925237393732045
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:vFB3t9DiYK8a4HHFLrgOIPcd1CyWpQ5fuiDbmpQ:vn3t5SzU5fu+
                                                                                                                                                                                                                          MD5:621B390B8AF0C70D682715323A92B61F
                                                                                                                                                                                                                          SHA1:C34B2F2C91CD0786FEBBD26223D1CB096A87C1F4
                                                                                                                                                                                                                          SHA-256:729B677BE93020DDEF1297869CA7378D3A102927294C634A1087D63F48FB8A79
                                                                                                                                                                                                                          SHA-512:E55691ED5FBCEF7AA8330CABDA72E9D803E12784B661A42FFE3FF725FE663AEF62EED407FDC2269135437AB7AE047A6F0CCEAA90F2349073E554DD45C5F9D0BC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................3.....N.....j...........].....!.................t...........p...........S...........}...........R...........J.....q.............................x...........H.....a...................................n.......................4.................A...........%.....A...........q.......................g.............................&.....G...........D.................!.............................A.................^ ..... ....R!....j!.....".....".....".....#.....#....,$.....$.....$....2%.....%.....&....5&.....&.....'.....(....E(.....(....P).....).....)....W*.....*....%+....R+.....+.....,.....,.....,.....-......................D/...../...../...../.....0....:1.....1.....1....o2.....2...._3.....3....s4....J5.....5.....6.....6....Y7.....7.....7.....8....'9....}9.....9....!:.....:.....:.....;.....;....M<.....<

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ar.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):897122
                                                                                                                                                                                                                          Entropy (8bit):4.928723053414015
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:CIPFaBsPG/d/RXZwRq4fvPU7XUUk/K58N0j+JzIQ4pF:CIvAAC5h+c
                                                                                                                                                                                                                          MD5:3C8E3C5B1D029E9A01943DDBA053C37F
                                                                                                                                                                                                                          SHA1:785EE0C46B11A19C80770F2B310057E59D90C2E1
                                                                                                                                                                                                                          SHA-256:98CD654847FF28C0EE580A7374276EE5BD2A38DDE8F45ADFBACBD7917E4C026D
                                                                                                                                                                                                                          SHA-512:DCA2FC0BE678BEBF047DBAA5A71C01AD57F9B463E3F80DBFABC0937BCFDCEEFC8AE84FD415C40D0B6B713FFF24CEBFB84373ECDDE3741F78265E082C5B9951D0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%Q.e.>...h.B...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....D.....I.....b...................................o...........,...........#.....E.......................0.......................$...........?.........................................x...........\...........\...........n...........s.....C.......................(.....{...........J...................................4.....s.............................r.................1...........;.....{...........K...... ....u ..... .....!.....!.....!.....!.....".....#....r#.....#.....$.....$.....$.....$....w%.....%....C&....X&.....&.....'.....'.....(.....(.....)....C)....i).....)....d*.....*....C+.....+....:,....X,.....,....{-.....-......................./.... /...../....C0.....0.....0....91.....1.....1.....2.....3.....3.....4.....4.....5.....6....e6.....6....+7.....7.....7.....8....g8.....8.....8.....9.....9....k:.....:.....:.....;

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ar.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\bg.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):927865
                                                                                                                                                                                                                          Entropy (8bit):4.686646990438899
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:4Tax7YKC3cquMMLYzzQkECPUwVbtbHp373ZL+3aAKHkVDYyKzumpod2nm5g0XuGq:W8C3cquMMLYUKUwVbtbHp373Zq3arkV8
                                                                                                                                                                                                                          MD5:27C55B97D549BCF13145EC75F0A503CA
                                                                                                                                                                                                                          SHA1:4D7BEC85366FBB602EB6FC02297FB402BD40B6BF
                                                                                                                                                                                                                          SHA-256:F2EB47878B5D34589A2AFC2E74AB346003BF4D2C450230B9CFD084935BB54A4D
                                                                                                                                                                                                                          SHA-512:CA3ABB2403B8A67A53F2156E11C361B137F45378737E39D45D5F77148FF3CD031E37DB9EA144B76749667CBA20698C2049E86CA5927475B1E22112751B9BDF3F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z................................................................. .............................K...........................................................V.........................................^...........p...................................&.....n.....X.............................L...................................I.....\.....5.......................E ..... ..... ....R!.....!....5"....]".....".....#.....#.....#.....$....?%.....%.....%....h&.....&....<'....['.....'....n(.....(.....(....g).....)....#*....I*.....*....|+.....+.....+.....,.....-....}...........Y/...../....'0....W0.....0...._1.....1.....1.....2....w3.....3.....4.....5.....5....06.....6....L7.....7.....8....A8.....9.....9.....:....8:....&;.....;....;<....p<....`=....;>.....>.....?.....?.....@....7A.....A....LB.....B....?C....wC.....D.....D.....D.....E.....F.....F....hG

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\bg.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\bn.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1193463
                                                                                                                                                                                                                          Entropy (8bit):4.299730648702171
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:o3d2APzZl1uPXdf826YBWviytaGHFGuzhr0Ylf14/QISydDbrK8VBbFKQg51lNDS:o3d3Fl18fPAtt1MFSydHrK8VBbG5llA
                                                                                                                                                                                                                          MD5:7351AE61AE5884088AE68CE5BE0043D8
                                                                                                                                                                                                                          SHA1:DBEEA5DA228F63A405548F0E6F82FBBB3D624058
                                                                                                                                                                                                                          SHA-256:D367339A1AC5CE27E58AA03D33E567C06C02F4AC87DB26ACA5D8A3D915AAA01A
                                                                                                                                                                                                                          SHA-512:85D5D0372C162DE8660B4A8A4EC493585C6C3D29F999F1734C319532DB572A13C91C87320BE139F9FFA957ADD52CDC36584226FAF5AFC39F8A82A2E9C146156B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.'...w.4...y.:...z.I...|.O...}.a.....i.....n.....v.....~.......................................................................Y.................I...........z.....Q...........*.....O.....I...........F.....>.............................G.......................G.............................Q.................t...........Z.....I.............................K.............................]............ .....!....Q"....."....n#.....$....L$.....$....'%.....%.....%.....&.....&....H'....{'.....'....~(....-).....).....).....*....(+.....+.....+....s,.....-....g-.....-....5...........!/....D/...../.....0.....0.....1..../2....K3.....4....^4....X5....'6.....6.....6.....7.....8....L8....|8....J9.....:....w:.....:.....;....d<.....<....s=....->.....>.....?....??....$@.....@....-A....eA....hB.....C.....C.....C....)E....}F....pG.....G.....H.....I.....J.....J.....K.....L.....L....0M.....M.....N....7O....fO....lP....@Q

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\bn.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ca.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):573774
                                                                                                                                                                                                                          Entropy (8bit):5.391859865204477
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:gQQL7QREpAp973K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuCJkdz:hb9zaBRnvWDMN8UpOO5k/mVb
                                                                                                                                                                                                                          MD5:F6E50323E0C5A657EBDC2FE7285C15F6
                                                                                                                                                                                                                          SHA1:944356D207A7962A81801BB76B0E2C5226FF7F1E
                                                                                                                                                                                                                          SHA-256:DE474CF24B68B6D862C96B8057EDE3F53C6F63C46532E4988E9D1979B1CF59DA
                                                                                                                                                                                                                          SHA-512:8BC4EA1E2EB03E0423A7C3008BF6001B904928B5B7D7E84D61469C8D8CDBD34E9A4FFFA900B7CBF4216FBA3A469D7A26AF9C22E618902C28044F426693B09EC7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........"&+.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.$...y.*...z.9...|.?...}.Q.....Y.....^.....f.....n.....v.....}.................................................................9.................3...................................n.................P.......................T.......................K.....~.................y.................n...........$.....J.................^.....r...........,.....c.....w...........U.................Q...........5.....[.................<.....X.......................(......................................... .....5.......................1.............................[.......................>.......................^.................0.......................3.......................V.......................t.................Z.................. ....7 ..... ..... .....!....(!.....!.....!....6"....R"....."....w#.....#.....$.....$.....$....0%....Z%.....%....)&....\&....|&.....&.....'....='....P'.....'....((....h(.....(

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ca.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\cs.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):583431
                                                                                                                                                                                                                          Entropy (8bit):5.838398613999325
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:eV2UufpvPlAhTbe65aU8rwsiNOA3SzmPN:eV2UufpvNAhHh5aU8rvYOrzmPN
                                                                                                                                                                                                                          MD5:7F1AD2897B210C4C25CFBDF0736F6809
                                                                                                                                                                                                                          SHA1:62E0335A63BC9E2AE8A9826E08256B00E433D9F5
                                                                                                                                                                                                                          SHA-256:E0826C8E2FE737307D09D808BC693A397E0F1E093AC249B24CEB48327685A4A4
                                                                                                                                                                                                                          SHA-512:C656B1FF7FCD93B3AEF5FC9E91373D0588520546EAF6CB5E2F965FD66ED0D60E2C04FB22155723D6EFDFDB377EF98CD6420F9944C5B0FC4AE8DE14C830A05B15
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&;.e.j...h.n...i.v...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.1.....9.....>.....F.....N.....V.....].....d.....k.....l.....m.....o.............................T...........G.....e...........).....^.....m...........p.................V.......................{.................$.....w.......................z.................7...........H.................$.......................N.......................w...........2.....G...........B.......................Q.....n.................*.....V.....h................./.....@.................F.....Z.................R.....d.................9.....F.................H.....[...........*.....d.....x...........m.......................`.....{.................0.....Q.....p...........7.....c.....y...........Y.......................w.................. ..... ..... ..... ....I!.....!.....!....."....t"....."....0#....B#.....#....T$.....$.....$....2%.....%.....%.....%....<&.....&.....&.....&....@'.....'.....'

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\cs.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\da.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):530651
                                                                                                                                                                                                                          Entropy (8bit):5.44607278354406
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:QnPhyMLsqSAzVWgss5sbse814eBjtwlRDdJwL2obEXZaFRQ5gk2rp/b3d4nTGqF5:WDgxsJjiT55g/r2Tpj
                                                                                                                                                                                                                          MD5:9D6A98D53208092F687AD7BB3DBAED7D
                                                                                                                                                                                                                          SHA1:161D0689CA85147B356167F98EAD84783E331986
                                                                                                                                                                                                                          SHA-256:04BF402123BFA1C7E256A62A666C0488A42ACEB585C1A9A744341EBC6FDD9A7C
                                                                                                                                                                                                                          SHA-512:B85832A3DBF5C97870683A655E2CB0F00C04DA4907644561894BB34DE9756334E60CAF75F0CB42E43692BF00C5EF3CFBE6D2E8F7802FFED8E6948757D2DE3E5A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................\.................".................@.....X...........d.................1.......................1.............................x.......................y.................<.......................w...........#.....6.................C.....W...........`.................]...........5.....[.................8.....J.......................#.....q.......................\.......................b.......................[.......................?.......................!.......................-.......................t.......................X.......................3.......................0.......................n.......................n............ ..... ..... ..... .....!.....!.....!.....!....:"....H"....."....Y#.....#.....#....%$.....$.....$.....$.....%....d%.....%.....%.....%....O&.....&

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\da.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\de.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):571551
                                                                                                                                                                                                                          Entropy (8bit):5.489447532911186
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:if1WFbCgp1nHaxa03K7UpKD93g/ahmOC2GzV6wAXaOV5jbt5sRqJoUaM5QIBCAL:wQAgnp03K7Up4g/a01JE3t5yUfvBCAL
                                                                                                                                                                                                                          MD5:851D55585CBC90143DD4C70EB4900574
                                                                                                                                                                                                                          SHA1:DA5DBD04CFEFE63D1DB69D7C6E19DAC34F379C39
                                                                                                                                                                                                                          SHA-256:DDBAFE037C6E7509650373D084BC0F198D3ABB7BFD93FAEDD5595F1B354EDC32
                                                                                                                                                                                                                          SHA-512:B1718430F3540F2455E93A1F6C47E92D7FEA99A9943E8C585EBD4DD807B5A4C1172BBDC83D434EE806C5FC3875B60D7EBDEB933D1CDE6DB50DCED9C0DAAFCD04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................|...........&.....5...........'....._.....q.............................w.......................q.................. ....o ..... ..... .....!.....!....)"....b"....."....."....c#.....#.....#.....$....}$.....$.....$....H%.....%.....%.....&.....&.....'....b'....l'.....(.....(.....(.....(....e).....).....*.....*.....*.....*.....+....)+.....+....(,....`,

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\de.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\el.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1016551
                                                                                                                                                                                                                          Entropy (8bit):4.766567786580532
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:WStxYcxPdGgxh1hxFFiL9+YJXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egJ:TtxYcxPdGgxh1hxFFiL9+YJXDsSaSmqv
                                                                                                                                                                                                                          MD5:F497F06BC0430F2FA1E2BFFC32E2B9C5
                                                                                                                                                                                                                          SHA1:38141C3F85FD4A8FCF2A82B0DEB68BD93F062F60
                                                                                                                                                                                                                          SHA-256:B3CB15115252BBF1363B7231ED32309C9E2E5B6EEEC1B2BBC2700A49A26E56D0
                                                                                                                                                                                                                          SHA-512:C455DE6466A9FA535C685163A6B4540DC00EB51CC5565ADDFB0E124E3A29CD4AFEC7AB9DF7848C9D3A6C7F435E1CC761F74D8F162D8BC7378D086E96EFA2E705
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z...........................................................R.....y.....W...........C.....>...................................X.................C.......................O.................k...........J.....j.....9...........X.......................(.....b.....4...........s...........u.....1.......................z...........0.....d.....\...... ....I ..... .....!.....!....!".....".....#.....#.....#.....$....<%....|%.....%.....&....m'.....'.....(.....(.....).....)...."*.....*.....+....1,....X,.....-.....-....'.....N....../...../....#0....D0....O1....W2.....2....%3.....3.....4....!5....V5.....5.....6.....6.....6.....7....(8.....8.....8.....9....Y:.....:....-;.....;....|<.....<.....<.....=....l>.....>.....>.....?.....@....!A....PA....zB.....C....KD.....D.....E....lF.....F....&G....6H....2I.....I.....I.....J....iK.....K.....K.....L.....M....zN

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\el.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):459985
                                                                                                                                                                                                                          Entropy (8bit):5.5152848417450615
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:HAeAGZgSZ+XKFELrqmjLCd3MP9ej7HXfaYISMv5n5CSEBcWRnFc:HjfZgseoEL5C3Ma7H6N5CSgc
                                                                                                                                                                                                                          MD5:F8EEEBF6B363D8578D769AA05FED5BA7
                                                                                                                                                                                                                          SHA1:12E8B6FE48CA49936769B766A9A13510D9569A20
                                                                                                                                                                                                                          SHA-256:1F7D3BEACD2A55F3BF2D3571BEF1D05FA333FADD9E6CA141C2525B0678824CDD
                                                                                                                                                                                                                          SHA-512:3AAE1B6881E50E88635336218D7C13ACF81687AD78FB902900746EB875D9DD29DBF83A1D51344DF617DD86E31BAAD04564460ECC48886308E742830412E8C71D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&..e.`...h.d...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....n.....{.............................~.......................|.................$.....}.................(.....t.......................J.....s.......................5.....B.............................v.......................l.......................H.............................^.......................^.......................*.....E.....T.............................8.....u.......................J.....|.................&.....S....._.......................!.....i.......................).....n.......................[.......................:.....].....s.............................{.......................J.......................1.....h.......................;.....j.....z.................W.....o...........B.......................X.......................N.....z.......................4.....D..................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-US.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):464664
                                                                                                                                                                                                                          Entropy (8bit):5.505055040425703
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:V0BSJCCPeiISZuw3jcMP9eD3D9faYLbcNx5FSZngP/eXywB:8SJDPeDIjcMY3DzA5FSHywB
                                                                                                                                                                                                                          MD5:4B6300C27E7575C32888C1F3364D5346
                                                                                                                                                                                                                          SHA1:C5F5E1D3524ACC96FB4E18C08B02F54ABF83C3D4
                                                                                                                                                                                                                          SHA-256:0945C89B16D4FEBA346E85E14792B772DCC6278F7DCA7FB099A6100C93E79740
                                                                                                                                                                                                                          SHA-512:3F21B6F4A3E18755B355CE5F20384D549B3F723104A67C67AE521D2C4544AA3095FADA8855A0CC1A10E7C5BF3E8F55D061AB2DCEC210F76101A61D9484D4EE6F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.I...t.R...v.g...w.t...y.z...z.....|.....}.............................................................................................................;.....N.................".....2.................-.....C.......................+.....w.......................<.............................E.....j.................4.....i.................".....S.....a.................#.....3.............................i.......................\.............................6.....U....._.............................e.......................F.............................V.............................>.....I.............................l.......................g.......................).....e.......................+.....M.....\.................5.....[.............................Z.......................?.......................;.......................`.......................a.......................+.....i.......................C ....t

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-US.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1031027
                                                                                                                                                                                                                          Entropy (8bit):5.210875521790238
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:HmdiMRfFgJWHLboEFFRyYHiLNQTCvXTOnXv1x7S6a8wGi4ADjn1VtuYtP01+Z5zp:H/sm5z9v
                                                                                                                                                                                                                          MD5:D5A14353A7FCC1F199F9234BD4551FF9
                                                                                                                                                                                                                          SHA1:7476E2846B6C0D03338A074D7FE325BB468992FE
                                                                                                                                                                                                                          SHA-256:E5CFEBD81831A65CA268866A8EEADB334F64FA3B0853BD550E5BB69724408FBC
                                                                                                                                                                                                                          SHA-512:BCE4FB535509834EA32ACBA72FC22B76CE591F9B6C1C15207B023460F59E9BC6F65118F816A82D235E7F20E26BF822EA102C95B5DA71FCFF099D56215945BD27
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................8.....[.............................k...........t.....=.............................f.................J.......................t.......................a.......................g.............................]...........i.............................P.......................q........................ ..... ..... .....!....."....O"....y".....#.....#.....$..../$.....$.....%.....%.....%.....&.....'.....(....[(....%).....)....a*.....*....C+.....,....s,.....,....R-..........~...........X/.....0....~0.....0.....1....x2.....3....M3.....4.....4.....5....J5.....6.....6.....7....J7.....8.....8....!9....K9....2:.....:....q;.....;....z<.....=....L=....r=....U>.....?....|?.....?.....@....EA.....A.....B....,C....8D.....D...."E....!F.....F....zG.....G.....H....dI.....I.....I.....J....RK.....K.....K.....L.....M.....N

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\es-419.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):560321
                                                                                                                                                                                                                          Entropy (8bit):5.366866302767652
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:jjxzJ7FnfONzx0T8puYnKwoR5g6qLFYUudBm+u:nP8/pQj5g64F4Tu
                                                                                                                                                                                                                          MD5:AAB525A7681AE93791B283205064E2B4
                                                                                                                                                                                                                          SHA1:A021DBDCD3F269B77D7133F47B63906FFF794F76
                                                                                                                                                                                                                          SHA-256:5EF4BB4558102F2E39669208BECE79FD5B474E0A87C8A1EED5BCD6B13DA6C6FA
                                                                                                                                                                                                                          SHA-512:841CD903FCF716692FF1873EDAC4FEB5F8B907AFEC1D0DEBFABB39255A74B9B2096FAE3E562E95893DAC731EF46D07B12B6A441975042981CC88638B7673B435
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.*...w.7...y.=...z.L...|.R...}.d.....l.....q.....y.........................................................................................v.................i.................Z...........7.....U...........B.......................B.....l.................<.....d.....u...........o.................n...........".....L...........).....n.................V.................)...................................j.................(.....W.....r.................K.....Z.................R.....h...........E.......................a.......................W.......................<.....l.....v...........D.........................................Y.......................c.................J.......................r...........) ....j ..... .....!....?!....Y!.....!....."....O"....h"....."....5#.....#.....#....*$.....$.....%....(%.....%.....&....z&.....&....#'.....'.....'.....'....5(.....(.....(.....(....7).....).....).....*

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\es-419.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\es.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):559178
                                                                                                                                                                                                                          Entropy (8bit):5.34611084339133
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:tMTZMKZuHswv12Jp/bNg86ip3+UxojFtnj45vzr700Iu96PZrk8jb:AZMKUGVVLpzojTnj45brY0sb
                                                                                                                                                                                                                          MD5:078BD56804D26C26E9AA4F41BF6549F6
                                                                                                                                                                                                                          SHA1:B1B575D34769F35CF28158BCB40C92264DECC551
                                                                                                                                                                                                                          SHA-256:99389110A1497D3999E8CB5799A629A471D221E07C2818CEFEEDB1C95BF5A9F3
                                                                                                                                                                                                                          SHA-512:4108B3BDED940A7D3939EE68DD489A4453391BAE548285867B81A50217C248280111853A1EB6838B6C079A01A74D11CEE61E7F441CBC6D7BA91F1DFAE3EE602F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t."...v.7...w.D...y.J...z.Y...|._...}.q.....y.....~.........................................................................................+.........................................v...........f.................c.......................u.......................v.................7...................................V.....t...........L.......................p.................@.............................#.....q.................K.....~.................@.....h.....w...........:.....p.................R.......................M.......................:.....k.....v.................N.....X.................E.....U...........C.......................Z.......................T.....{...................................A.................1 ..... ..... .....!.....!.....!.....!....."....."....."....."....>#....X#.....#....l$.....$.....$....o%.....%....:&....c&.....&....F'.....'.....'.....'....@(....f(....y(.....(....J).....)

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\es.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\et.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):509452
                                                                                                                                                                                                                          Entropy (8bit):5.455817407928288
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:Z0izVKnUJ1HNRSUSx+DuM/Fb0WmFosQ4Eqsoh7Pwiw4dQH5ejnrlvCKMvaKWcEzn:vVKi7S65JmFosZtQH5ejJsW
                                                                                                                                                                                                                          MD5:45E28E64378FABED845EB242A8F1563D
                                                                                                                                                                                                                          SHA1:8FAA0651CA0D29596CA294DC448CB870D553C0FF
                                                                                                                                                                                                                          SHA-256:68386C75B1E414B5F94E1AA5EB9A98A42B6298177FABB834A8B9E96E1EF70A2D
                                                                                                                                                                                                                          SHA-512:3165EC45C2958C382832E4528D38966C28CA90C84777FD48D762FBD75F31FD52BD1B2C069BA4644504913219FAD5DDC08980F69DC67B9AB03D392AFC1321C339
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........:&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.!...s.2...t.;...v.P...w.]...y.c...z.r...|.x...}...............................................................................................................................t.................&.......................I.......................I.......................;.......................=.......................M.......................w.......................{.................'.................).....A...........6.....{.................W.....y.................=.....`.....l...........!.....K.....[...........).....c.....n...........5.....o.....}...........6.....g.....o.........../.....b.....q...........0.....d.....l...........T.......................U.....t.................H.....l.................<.....t.................I.....}.................L.....f.....w...........;.....c.....{...........G ..... ..... .....!.....!.....!.....!.....".....#....I#....n#.....#....J$.....$.....$.....$....-%....I%....]%.....%....+&....Y&

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\et.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fa.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):825360
                                                                                                                                                                                                                          Entropy (8bit):5.0557125829631335
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:FqvG8u313uyqoT+s1qLpRmX1loT4RmdAQifaQ2XxFMJGk620dri1HMX9O9xdpxHk:Evpu55M
                                                                                                                                                                                                                          MD5:A13029CB1D5873121E6BDD0929A6C772
                                                                                                                                                                                                                          SHA1:7B88AE77DF959B8C01F5F00F2B0DFC30ED0A85EA
                                                                                                                                                                                                                          SHA-256:2527D1821D08E43D2F1259A1F910AF986632B8AEF9257D2FC37BC285AF7EE217
                                                                                                                                                                                                                          SHA-512:AF272D021316A71CF2A98126AF9CA993122B3B7B766C6D34003BCDC2FC5936BC4FAE95293B1D74FE35A0C81150D45E95ADABC4B34118974D214049FCDBEE74CA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%p.e.....h.....i.....j.....k.*...l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....|.....}...................................................................%.....A.....k...........w.....H.......................M.......................]...............................................K.................=...........#.....D...........}.......................O.................Y...........E.....a.................................................................*.....N...........W.................,.............................!.....c.....z...................................@ ..... ..... .....!.....!.....!.....!.....".....#....R#....t#.....$.....$.....$.....$.....%....I&.....&.....&....L'.....'.....'....!(.....(....h).....).....)....}*.....+....j+.....+....>,.....,..../-....u-.....-....k.................e/.....0....a0.....0....&1.....1.....2....%2....#3.....4.....4.....4.....5....N6.....6.....6.....7....98.....8.....8....39.....9.....9.....9.....:....G;.....;.....;

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fa.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fi.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):517467
                                                                                                                                                                                                                          Entropy (8bit):5.424845538875905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:RKUtqd19KJOKu4ar5HZ7kfCHEpyWaZ7WYM:Ntq8S5HFHAl
                                                                                                                                                                                                                          MD5:E7B72F44D711DECE8E3043173A553AC4
                                                                                                                                                                                                                          SHA1:892424E4E011AAC47B068F9FD929B5E41BCCA525
                                                                                                                                                                                                                          SHA-256:5F1A9DF87400AF56F748026F3BAAA41756A4C42FCE4791AABFE2087441689340
                                                                                                                                                                                                                          SHA-512:A2907B8E12CCDD0FC5601C37F23CCD5556B4EAE18CB1833481D01B39B30EC643167B0C8295EC9EE8CE851B0C7968E83F9C47C6E1D4543A371A62485D1832835A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.....................................................................................'.....@...........E.......................s.................(.......................O.......................Y.......................7.............................\.........................................9.......................5.......................8.......................X.................&.............................[.......................!.....k.......................;.....e.....o.................N.....[.................#...................................l.......................a.................0.....~.......................K.......................A.......................?.......................I.............................f.......................^.................7.................................... ....2 ..... ..... .....!.....!....p!.....!.....!.....!....7"....."....."

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fi.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fil.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):584976
                                                                                                                                                                                                                          Entropy (8bit):5.195604084490558
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:4ln56kcajNxYUC36tIQy7DQEuq2V8L0dnGNLmG5eXmi1YARFtK:KnAkcmqnxEG5omt
                                                                                                                                                                                                                          MD5:F7F3CC17509AF03E639E983A091C2026
                                                                                                                                                                                                                          SHA1:D36E61E50B5FA99BE2A3C3727AFEB142969C8308
                                                                                                                                                                                                                          SHA-256:5D586C9BFA38452CDFB50BF5D2E9B98E68A8E7CC73E4D641D8FD6BB3E7EC5712
                                                                                                                                                                                                                          SHA-512:5A2C037D0AFDC82A4ECA642F43CC10E0040B7F97BE9DA14A8F806970C1E07BEC9CD69AD816A91A41946F35FF7A760ACC65DF21F6CD9D365ACBBA345FF0C1FF70
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~...................................................................................-.................(.............................4.................5.......................h.......................u.................+...........+.....i...........+.................#.................[.....q...........[.................1.............................5.......................s.......................i.......................R.....|.................h.........................................&.......................(.......................).......................M........... .....=................./.....M.................. ....! ..... ..... .....!....2!.....!....'"....n".....".....#....l#.....#.....#....&$.....$.....$.....$....j%.....%.....&....A&.....&....u'.....'.....'.....(.....)....S).....).....)....d*.....*.....*.....+....j+.....+.....+....",.....,.....,

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fil.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):606342
                                                                                                                                                                                                                          Entropy (8bit):5.380118288987104
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:n2sEZLqUMDpDgEL6QuaMVWXKz05qlZQmZyMYnYtkL09ujzxRe5hxkJSW7v40wCJ/:zj2VIN5JL
                                                                                                                                                                                                                          MD5:326917C8F37FE85E58AD3DE991D17A78
                                                                                                                                                                                                                          SHA1:683ED0FB95F33DC2B095E774AD3DE84B0E4A63E3
                                                                                                                                                                                                                          SHA-256:CFA45E5F86F70AE4D47D82BCEC6C245E618212E67CE8B7BF0A1BE0BE41C6E6E8
                                                                                                                                                                                                                          SHA-512:3FDF2B1C8031A06D5140449E22861545CC80E1417A70558DB2ACAC25733AC156A0D7941B053A7CFFB2ED193BBE5E0CAE4F1F68437FA570C612BE606DD10ECAE1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&<.e.h...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z. ...|.&...}.8.....@.....E.....M.....U.....].....d.....k.....r.....s.....t.....v.............................Z...........z...................................k...........P.....l...........G.......................x.........................................c.................>...........).....l.................n.................&.......................\.................-...........Q................./.......................0.......................*.......................B.......................[.......................^.......................K.......................D.......................o...........S.....j...........0.....^.....|.................4.....R.................X.....t...... ..... ..... .....!....[!.....!.....!.....!....[".....".....#....!#.....#.....$....Z$....z$.....$....x%.....%.....%....f&.....&.....'....>'.....'....I(.....(.....(.....)....^).....).....).....*.....*.....*

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\fr.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\gu.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1177779
                                                                                                                                                                                                                          Entropy (8bit):4.338116428198543
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:C3T12vbLPxCoYITYsRvc38ZUd02GHIwjAwREJKVMjNiT7llj63rhJXlPCKMi5eWt:dTbYITncQi02JCWJL5DAhc2T2
                                                                                                                                                                                                                          MD5:D77AEE1AB6AF4FC83813A69D3CA61E46
                                                                                                                                                                                                                          SHA1:C0786021AF8C8BBB083E9C4104B68BD28537893A
                                                                                                                                                                                                                          SHA-256:5D5E20C5F0CA21D8F1824EEBE8E595FAD4D0E601B224F4433B355A21B643971F
                                                                                                                                                                                                                          SHA-512:78C2589BC37594236D5B01C4C6C0CB934CF9CCAE15679159E1BCE64E3F5A3C903F9F7127D0DA8C317FD085A70EDFFDCAC413B4F2627BF14B862794B47BBA042A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.;...w.H...y.N...z.]...|.c...}.u.....}.............................................................................(.....`.................j.................Z.................F.....).............................#.....L...................................=.......................U...............................................|.............................E.....q.....n.....i...........+.....N.....\ .....!....D!.....!....n".....".....".....#....H$.....$.....$....O%.....%....?&....X&....$'.....'....=(....h(....$).....)....?*....a*.....+.....+.....,....),.....,....}-.....-.....-..........S/...../...../.....0.....1.....2.....2.....3....74.....4.....4....;5.....5.....5.....6.....6.....7....08....V8....a9....,:.....:.....;.....;....s<.....<.....<.....=.....>.....>....)?....)@.....@....mA.....A.....B.....C.....D.....D.....E.....F....vG.....G.....H.....I.....I....*J.....J.....K.....L....4L....SM....0N.....N

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\gu.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\he.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):728589
                                                                                                                                                                                                                          Entropy (8bit):4.658856122190603
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:W5SDjhr3FluYMy31frspm29Wqu/kQl4JACVXbfeQCajLn5l67co+oiNB05elmmdi:W5SdY5/oP
                                                                                                                                                                                                                          MD5:04C846A7F65C1E95E49CFE69EC9EEB45
                                                                                                                                                                                                                          SHA1:78142FD5545EE76B1F90FF5DF6FB7C01D797F3D1
                                                                                                                                                                                                                          SHA-256:AFAFB0DADD253E7F665FCB0D9D562D243E32D774B6ABDF602B66734F310E689B
                                                                                                                                                                                                                          SHA-512:029F45EE02DAD7D3431B223F5516937E34D685026488BA2DBF7C43FFDEDD1240FA119C349E4F5052CA3FDE109215D6D8813A43297A7E4EDB5D9B063192AC775A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%N.e.D...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....i.......................}.....3.................g...........%.....>.........................................a.................x.................E...................................=.....m.........................................s...................................q...........8.....Q.......................E...........+.....V.................m.................I...........!.....8...........*.....j.....}...........s.................B.......................s........... .....3.................\.....o...... ..... ..... .....!.....!.....!....."....?".....".....#....>#....b#.....#....Y$.....$.....$....g%.....%...."&...._&.....&....''....H'....a'.....'....D(....u(.....(....4).....).....).....*.....*.....+.... ,....D,.....,....l-.....-.....-.........../....b/...../.....0....u0.....0.....0....~1.....2....k2

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\he.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hi.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1250127
                                                                                                                                                                                                                          Entropy (8bit):4.3103395858193565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:AubcffOrA0yUdRSM7vyWYfbXpgTMoV/BB0ZV1d1AuxXRLiW3Jk1eTByntDPtDl+U:AuAf2E0yjUv3MlgTMJem05f5xhbv
                                                                                                                                                                                                                          MD5:114BBD0D21C90DDFCE1D6E26432B7B9C
                                                                                                                                                                                                                          SHA1:EBFC476B4D742D9FDF5D0E78996748497EB0B4FF
                                                                                                                                                                                                                          SHA-256:E2321752811548A92EF069E53ABE349CAA93BE5596A2579DDE65391EE7CF915B
                                                                                                                                                                                                                          SHA-512:6195FC185F8297CA1C38B79339F86F0788B342A90B0E98F1ED5883CBE61725000B1653E911EB749351BB74802B8E75199DCF0C95D903A4422755E809A6A1814D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%_.e."...h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....R.....w.....................................................g.............................8.....+.............................6.................~...........y.................+.............................8...........^..... .......................W.......................................... ..... .....!.....!....."....y#.....#.....#.....$....b%.....%.....%....s&.....'....M'....f'....=(.....(....b).....)....R*.....+....d+.....+....3,.....,....3-....O-.....-................./...../.....0.....0.....0.....2.....2.....3.....3....x4....#5....p5.....5....76.....6.....6.....7.....7....n8.....8.....9.....:.....:....A;.....;....O<.....<.....=....]=....Q>....-?.....?.....?.....@.....A....BB....zB.....C.....E.....E....+F....9G.....H.....H.....H.....J.....J....~K.....K.....L.....M.....M....:N....7O.....P.....P

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hi.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):562949
                                                                                                                                                                                                                          Entropy (8bit):5.503469092776888
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:5pEDgLd6TlZ/9yZuYUapEXgaBV08L7SkK7D+wwWrDfB+uhAxqOSAq6+xMcwd0uPJ:HEDjTMzU0EV7xHwPBhbKBc5ag7yIjR/K
                                                                                                                                                                                                                          MD5:54308E58D399D0F1C4E66A4A4B6E3B59
                                                                                                                                                                                                                          SHA1:8DFCE74D45801654531C78E34CF6A6C2E4BA5556
                                                                                                                                                                                                                          SHA-256:8141D126CD8ED7CD29B998E4A778E81AEC043BC126B5D2B0FB62F95C5FBF1F62
                                                                                                                                                                                                                          SHA-512:33C74ACE0F430D2E7963512075007DCA70ADCDD43FCE31A27F925351CEB00CFECE329EC5E9B60DACFF7E28DA322FC9CEFF3FCD9AE3A7BB6655400F1A580C3EA2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........F&..e.....h.....i.....j.....k.....l.....n.....o.....p.'...q.-...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.......................................................................................................C.................0.......................c...........#.....B.................R.....h...........".....T.....d.................2.....B.................G.....l...........i.................D.......................k...................................L.....g.............................e.......................C.............................U.....v.................I.......................D.....r.................L.......................A.....l.....|...........'.....T.....d...........T.......................Z.....|.................@....._.................(.....U.....l...........K.......................m.................. ....u ..... ..... ....G!.....!.....!.....".....".....#....t#.....#.....$....n$.....$.....$....9%.....%.....%.....%....'&....p&.....&.....&.....'....|'.....'

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hr.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hu.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):605952
                                                                                                                                                                                                                          Entropy (8bit):5.638270541961174
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:n0L6iTfLsgtbgq0LcP9wHs8DfcAujkatvV5RvBFZfpduYG3b7ZNIeHK9njDi59Rj:iTfrtcFQA0V5RvBn0zzKY5u0vv
                                                                                                                                                                                                                          MD5:B7AA52653BBABCC713A03067E6FCFCC3
                                                                                                                                                                                                                          SHA1:B18CC0B968C4C0F156E33F5C493E6C09760161DD
                                                                                                                                                                                                                          SHA-256:244BE241E2FD68882ADB0C1A1C4AE93B1406AE22CCC14BCB37FC09FE3C2831A5
                                                                                                                                                                                                                          SHA-512:CB393247F79F1A6CDD685AD9729D0C7FD3BFADB5591CD822A4F92BA19448E50C148517DC0DDC14C37243CC0145A5AB17D27C45CCEBDCCB76CEC70C1B444D07C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&L.e.H...h.L...i.]...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....W.....g.....}.................T...........u...................................f...........L.....f...........^.........................................(.......................{...........-.....^.............................s...........(.....:...........!.....c.....s...........v.................k...........W.....v...........j.........................................).......................q...........M.....d...........n.................>.................+.................W.....l...........r.................C...........(.....>..........." ....I ....e ..... ....0!....\!.....!.....!....L"....."....."....4#.....#.....#....&$.....$.....$.....$.....%.....%.....%.....&.....&.....&.....'....c'.....'.....(.....(....%)....4).....)....[*.....*.....*....s+.....+....:,....V,.....,....$-....U-....q-.....-....b.......

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\hu.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\id.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):500354
                                                                                                                                                                                                                          Entropy (8bit):5.374540321275158
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:HDTG/Veh932Bmcwf/yG+wFZf+MVnjHF3mmi8IxZ5GZhWwkK5cTSzo7IEji4JHw:HHG8h94sXyMFTVnjHFWmNIb5GZhow
                                                                                                                                                                                                                          MD5:0EFA0011CE0365AE4AFC08753F559098
                                                                                                                                                                                                                          SHA1:6AFC5115DFC222F0F2B2265A591B571803787DCA
                                                                                                                                                                                                                          SHA-256:A780C4E8E48CBDF2064CFF3E9E025103739B3763E3B82DDD99C97DFFF8FB1CE2
                                                                                                                                                                                                                          SHA-512:21C34901F5260606F14FE0E004851AF4DFA6960C28872417FB995ADAC4B2652609D9C0F5F30C0F76F4287217ADCDC0ACF1545CBD4E5A6F4B15565668840BCB75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................@.......................`.......................Q.......................m.......................p.......................N.......................8.......................@.......................4............................._......................._.................!.......................(.....e.......................$.....I.....U.......................!.....|.......................c.......................>.............................e.......................L.....~.................?.....u.......................(.....9.............................b.......................C.......................'.....c.....}.................=.....k.....z...........6.....r...................................Y.......................l.......................B ..... ..... ..... .....!....q!.....!

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\id.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\it.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):558299
                                                                                                                                                                                                                          Entropy (8bit):5.272942823509238
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:qrF11tFO6w7oWhI7xO2/IJ/jNLiISIqRRRsO1StiRT9TjexKqcQxLcaPpzHi9fLN:u1tFFehoXFZxR8g26sjoh59koF
                                                                                                                                                                                                                          MD5:12FFE0FC0BE1B4134F219BD3B6D8F550
                                                                                                                                                                                                                          SHA1:DC14159AEA6643FEED260C3E3EB9BF4286FFFD9C
                                                                                                                                                                                                                          SHA-256:4FFAADC42BB0F78B78061EEC23B39BEBF34BA3B9B4F2CD0415FD3C94B2C828D3
                                                                                                                                                                                                                          SHA-512:423EB3AA074617C8FB64EA909CF860C8706B73B5CBC97D85D21E9298DC53CF9451DECCB1DE45B19377E8E2461D78282D587264340BCE8F487AD48B0DDEE55123
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...|.V...}.h.....p.....u.....}.........................................................................................w.................X.................2.................'.................g.................(.....O.....].................$.....3.................L.....v...........n.................X.......................y.................".................?.....X...........R.................'.....s.......................W....................... .....G.....R.................\.....n.................J.....U................. .....).....x.......................Q.......................Z.................,.............................U.............................d.................(.......................c.......................>.....|.................J ..... ..... .....!.....!..../"....."....."....<#.....#.....#.....$.....$.....%....W%....m%.....%.....%.....&..../&.....&.....&....:'

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\it.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ja.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):677279
                                                                                                                                                                                                                          Entropy (8bit):5.7261443457831875
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:5mNTLdjIcq5eHWv0WSGRBZ6Q2T+NbX5+Fo1Vi:5mNTxqe2ccBZ6Q2T+h5+FF
                                                                                                                                                                                                                          MD5:A92DA679A63FB99BB5F3BCF829168D21
                                                                                                                                                                                                                          SHA1:F15AA9BA6A952490DD881C82DED179FE03E50E80
                                                                                                                                                                                                                          SHA-256:F78FEB7523A3B4C795AC02EB66FD455B0F490257549D681B7AA07255E99AB9D9
                                                                                                                                                                                                                          SHA-512:3055528033206B6F32371A1BA05633614C0A3A9AF4FE2326FA3E6689BF535D5D540D926E08963FB668B02EEFF216DC2ECABED035C821C83E5D96CD2ED1531835
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........e%..e.....h.....i.....j.(...k.9...l.B...m.J...o._...p.l...q.r...v.~...w.....y.....z.....|.....}.....................................................................................1.....O.....p...........+.................'.................Z.....r...................................|.............................9.....K.................F.....V...........R.................@.................%.................8.....H...........#.....T.....c...........D.....{...........3...........5.....P.................6.....R...........S.................A.................*...........d.................`...........2.....A...........=.......................}.................P.................1...........j.................j............ ....: ..... .....!....Q!....r!.....!....^"....."....."....f#.....#....*$....d$.....$.....%....>%....M%.....%....R&.....&.....&....''.....'.....'.....'....z(.....).....).....).....*.....*.....*.....+.....+....1,....w,.....,.....-.....-.....-.....-....k...........4/....O/

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ja.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\kn.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1341496
                                                                                                                                                                                                                          Entropy (8bit):4.250874916501427
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:v/9cYunn57Dz6f03QIBR0UInI7L5IazUG4pt+h9lcQ:nCYu5i25PUS
                                                                                                                                                                                                                          MD5:F13C1631BB1E180C07CB10C5142CEC74
                                                                                                                                                                                                                          SHA1:BD3B971893D3CE2206EDD040ED0EAB9BA010BD18
                                                                                                                                                                                                                          SHA-256:3A63D9B5BDECE8442ACA6971771A660BCEAE995CA96394FA88B024FEF3C93BF7
                                                                                                                                                                                                                          SHA-512:9122A55CE0E09ADAFE0162337B518228441D9A852E68761BFB62B656415F25386B3DB41279699F8035BE3BB3EA003FCBA91B5D5FC6EC538EF79E9486A488280A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........M&..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.........................................................................(....._.................j.......................A.....I...........X.........................................]...........Y...........P...........q.....:.............................q...........2.....A...........y...........S...........".....1 .....!.....!.....!....)#....?$.....%....Q%.....&.....'.....(....@).....)....r*.....*.....*.....+....@,.....,.....,....U-.....-....>.....S.....6/...../....w0.....0.....1....?2.....2.....2.....3....B4.....4.....4.....5....p6.....6.....7.....7.....8.....9....@9....b:....a;....!<....P<....3=.....=....Q>.....>....>?.....?.....@....,@.....A.....A.....B....`B.....C....PD.....D....eE....MF.....F....RG.....G.....H.....I....'J....yJ.....K.....L....TM.....M....(O.....P.....Q.....Q....8S....6T.....T....lU.....V.....W..../X....|X....IY.....Y....\Z.....Z.....[.....\....]]

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\kn.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ko.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):569413
                                                                                                                                                                                                                          Entropy (8bit):6.084713993678112
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:OA7Ny//OV2Ngi7QFIyjxMSVG0GTin8t8OQ4E3hvaYrSCqD5tEp7YqGT8U13Xq7hy:OA7Ny/oZO5L8frCT
                                                                                                                                                                                                                          MD5:E8448C3D352C76C1C0F2B9F508852D9A
                                                                                                                                                                                                                          SHA1:2B7FE9F0A49FE3428E467A4214D0E7EC79CF7B52
                                                                                                                                                                                                                          SHA-256:30D515F2E086A7773DD3C7B5E6504729B6D91D9FA7174C3226EB3553F900BBF2
                                                                                                                                                                                                                          SHA-512:AE4144323E7EB2C2C97F336EE144C0C739CB5500F7FF382469CB4CE33DBAE35078EACD85F50381912C9D4367DFC9CBCB6C7C7BCE8314A0351B14F950A2209184
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........>%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s./...t.8...y.M...z.\...|.b...}.t.....|.....................................................................................................A....._...........8.....y.................p.................3.......................Q.......................V.......................e.......................v.................+.......................!...............................................+.................{.................D.....h.................%.....J.....Z.................%.....5.................W.....s...........7.....k.....{...........B.....v.................E.....u.................C.....t.................y.................:.......................*.......................5.......................O.................#.....t.......................?.......................B.......................U............ ....& ..... ..... ....0!....G!.....!....."....>"....Q".....".....#....$#....7#.....#.....#....($....;$.....$

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ko.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\lt.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):611429
                                                                                                                                                                                                                          Entropy (8bit):5.6299671018290445
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:QQtetgAZbMAUbgO9aG1DT/G57szII1JgNf6SMM:QDgiMQzOG55IngN/
                                                                                                                                                                                                                          MD5:F6F5B593C91B7820C9552FFDDFAC03FC
                                                                                                                                                                                                                          SHA1:D771AC14A49C7654043D0AE2DC52239BF4636F65
                                                                                                                                                                                                                          SHA-256:FFE7EAC4BC39085977C28BF8BA0060B9A12471C3914A30DF1C46305926242BB6
                                                                                                                                                                                                                          SHA-512:45D3580D456F6972259055BFFEDE8745C922DFE2703BCF3A545E73211164E3CA594A56330A2A17EC373AB060C05A7776D88DFBAB5014081948A5F89A849F793C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................v...........d...............................................i.................z.................D...................................?.....V...........P.................3...................................D.....U...........C.....}........... .............................&.....t.................t.................#.......................N...................................E.....X...........L........................................._.................(.................C.....Q.............................h............ ....( ..... ....9!....s!.....!....."....."....."....."....m#.....#....*$....]$.....$....4%....V%....i%.....&.....&.....&.....&.....'.....(....J(....n(.....).....).....*....!*.....*....*+....h+.....+....&,.....,.....,.....-....j-.....-.....-................./....Z/

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\lt.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\lv.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):610750
                                                                                                                                                                                                                          Entropy (8bit):5.626685122127425
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:IbsBLMwr28cTB6aTmNstVFpM6Y97vccj/kbO153ySAbEwT4757esFOHAYXSIENAs:FL8PXVY9rrV15SEwTW5tOmAhm
                                                                                                                                                                                                                          MD5:8D8244CEA7D00E7502CFC62908147BB7
                                                                                                                                                                                                                          SHA1:2ECF5C264208555EC5BD4530544CC0AEE99F558F
                                                                                                                                                                                                                          SHA-256:C9722A6B132E9EF5BCA53565BCBC2CB3C40CB8954F2286250AD15FAFC0D2DCC1
                                                                                                                                                                                                                          SHA-512:B5B98ADE8D7EA25477D12CBEB6B1F07FEC5625583B8CC695755195B1EEF0D380C72AE4609955D230B4FD6109AA6B778421E7EAE9D7086FEC03CFF93C93D91791
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........J&..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.R...t.[...v.p...w.}...y.....z.....|.....}.....................................................................................$.....@....................... .................T.....g.........................................Y.....x...........W.........................................O................. ...........e.................H.............................&....._.....r...................................*.....z.................f.......................o.......................}.................5.................$.................:.....L...........:.....q.................i...............................................#.....u.................P ....k ..... ..... .....!.....!.....!....5"....."....."....."....j#.....#....:$....t$.....$....A%....a%....z%.....%....~&.....&.....&....J'.....'.....(....%(.....(....|).....).....)....z*.....*....5+....[+.....+....V,.....,.....,.....-....r-.....-.....-....4............/

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\lv.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ml.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1394062
                                                                                                                                                                                                                          Entropy (8bit):4.285571867304228
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:MYNjRdBR8QA2cMmsbbAx4LJxFq/ixn9mMy6UQ6KfUBp/AZCBEmeyo3ewhp5O47uW:RZRltMTKfUBpUyo3eo5O47xs4+3e
                                                                                                                                                                                                                          MD5:979090995F7F9DBFA9FA9A96349DA745
                                                                                                                                                                                                                          SHA1:6D9425EB6D3FF6B433A2FFD89DFFB3AEDCDE3588
                                                                                                                                                                                                                          SHA-256:C27AC1727F3A3A25ABED09CBF07DA604DD1C42A1855851E63DFCDC9831091EDD
                                                                                                                                                                                                                          SHA-512:4D734D7903DD4C39A2392EDA7B6A65929E61FE105ED843718D5CAF8D93DA9FF14A8908B896425335FCE9CA5AE717C29C80E7D85A2A6B80DF9F4FAC8F7A558F38
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........G&..e.....h.....i.....j.....k.....l.....n.....o.....p.)...q./...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}...............................................................................b.................T...............................................c.................................................................\.....M...................................8............................................................ .....!....s".....".....#.....%.....%.....&.....'.....(.....)....2*.....*.....+.....+.....,.....,.....-....".....P....../...../....40....h0....J1.....2.....2.....2.....3....I4.....4.....4.....5.....6....#7....W7....C8.....9.....9.....9.....:....i;.....;.....<.....=....?>.....?....C?....-@.....@...._A.....A....\B.....C....PC.....C....nD....;E.....E.....F....BG....*H.....H....HI....,J.....J....TK.....K.....L.....M....NN.....N.....O.....P....IQ.....Q.....R.....S.....T.....T....&V....-W.....W....=X....kY....fZ.....[....Y[....J\...."].....].....]....+_....:`.....a

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ml.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\mr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1147816
                                                                                                                                                                                                                          Entropy (8bit):4.319695697825778
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:p+xh0ke1h+Fnhb0paSpgKZmTDAyyLj5QpYGde:p+TUA0paSppZ+Ayyf5QpYGde
                                                                                                                                                                                                                          MD5:7862ABEC5008FAC0A8924B65B3058C05
                                                                                                                                                                                                                          SHA1:BC6A3F405835E3F3290CB521CA2A9AC85EAECDC4
                                                                                                                                                                                                                          SHA-256:44056C45DE472FF1A5037FC24CC2417218CF4FA500B6A7158BD8AA221268B69F
                                                                                                                                                                                                                          SHA-512:C91A1DCC08EAECF7F99B37684E02F3F89D18DBAF24B2BF3849CE78965A38E8A995ABBA03C0F8F20420AA15519439F0C662165BAA6A31BFE3CF994AA51F67C8F8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%O.e.B...h.F...i.`...j.l...k.{...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......#.....(.....0.....8.....@.....G.....N.....U.....V.....W.....\.....~.......................c...........Y...................................$.....Q.....'.....x.....~.....{...........4.................".....d.....0...........d.................l...........&.............................%.....(........................ ..... ..... ....."....3#.....#.....$.....%.....&.....'.....'.....(.....).....*....E*.....+.....+.....+....),.....,.....-.....-.....-.........../.....0....f0....N1....$2.....2.....2.....3....G4.....4.....4.....5....G6.....6.....6.....7....Z8.....8.....8....$:....M;.....<....N<.....=.....=.....>..../>.....>....t?.....?.....?.....@....^A.....A.....A....&C....!D.....D....7E....!F.....F....?G.....G.....H.....I....=J....~J.....K.....L....@M....sM.....N....#P.....Q....3Q.....R.....S....1T.....T.....U.....V.....W..../W.....X.....X....)Y....RY....sZ....g[.....[

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\mr.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ms.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):524044
                                                                                                                                                                                                                          Entropy (8bit):5.251286724342732
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:SgRSValNdUMLjehAr7nQjBx7+27fldjiMIUcGm95AIHxOMVLLEWVHs:SOSmu0jeAnEx7BldPc95n0Mu
                                                                                                                                                                                                                          MD5:5EE8AEFF66C42600D73F9CB7D8366CCE
                                                                                                                                                                                                                          SHA1:DAB706F52B7F6099286D659EFC24ADBAD9F5A4F2
                                                                                                                                                                                                                          SHA-256:A87B9926FBC7C17D884ABE1D8E4B81335476B00FFE76196E38AF8542E2D7881D
                                                                                                                                                                                                                          SHA-512:96145B505C3726878162EF4AE328F08888F1CBCF3C3D8AADFCE4E72398651D1B120C4D219176E107F99BD682D968D3C8F02AA8BF600007033AAC07064127A8EA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........S&..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.....................................................................................5.....L...........S.................'.......................;.......................m.................0.............................}.........................................*.................^.....v.................C.....L.................".....-.................&.....7...........(.....{.......................9.....K.............................i.......................O.......................\.......................U.......................E.......................5.......................C.......................f.......................N.......................).....u.......................^.......................>.....V.....b...........#.....T.....c...........0.....q............ ..... ..... ..... ....S!.....!.....!....."....k"....."....."....."....G#.....#.....#.....#.....$....o$.....$

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ms.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\nb.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):508553
                                                                                                                                                                                                                          Entropy (8bit):5.428763068409714
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:h63MVtpURb8w5Op7fQ9S8GNxRV5/n4FJFEWt:h63MVXUa65GNxRV5f4jFP
                                                                                                                                                                                                                          MD5:40B668B73BBF3575D009F3D528D388E5
                                                                                                                                                                                                                          SHA1:E7186E4796216615F388C8A8058D898C4913F2FD
                                                                                                                                                                                                                          SHA-256:8813FA272B1A12042C75B97848605C8DA7D306AC7AAA4F231D41EE98D9E70538
                                                                                                                                                                                                                          SHA-512:8858E78493FBDBE1B2B99BCE75DAAC585F40EEA2612D80D82850F7957F0EF69C3A1F3DC7C011427CB1E64CD667031DEBD3B3D160BB9C2146224377A99B74798A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........*&#.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...............................................................................................}.................[.................3.................!......................./.............................v.......................w.................&.................H.....k...........x.................R...................................S.....m.............................L.............................m.......................P.....u.................L.......................X.......................^.......................S.....|.................J.....x.................p.................&.....~.......................b.......................G.....i.....{...........h.................9.......................? ..... ..... ..... ....T!.....!.....!.....!....b".....".....#.....#.....#....+$....u$.....$.....%....f%.....%.....%.....%....A&....^&....l&.....&....6'....e'

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\nb.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\nl.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):525362
                                                                                                                                                                                                                          Entropy (8bit):5.366124885898627
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:TZpCbai+lbWusvbgQ5Pax5ttonxEGp7KY8OTy:3Cmi+lbWusB5Pax5tenxEGp7KYH2
                                                                                                                                                                                                                          MD5:6E38F51EBC9B4AF616C984ACFEF7323E
                                                                                                                                                                                                                          SHA1:1D871E09B051CDF1429FBB68FC43B7631DAD9438
                                                                                                                                                                                                                          SHA-256:E3ED1D14209965FACA5AC6A2B4026A4A28D21F5096E0C44943E731279190D540
                                                                                                                                                                                                                          SHA-512:4124F5ED6E9AC7701837AAE5458DB96DF8303FFF05ECBAB40D938CF0FDE3C5F2F696D07F0BE2227040A14336D2701F8A76342550419630F51C073070DC705492
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................U.................4.................@.....T...........;.......................c.......................[.......................?.....g.....u...........M.......................}.................4.......................=......................._.................(.................g.......................C.....W.......................$.....y.......................h.......................j.......................O.......................,.............................v.................,.......................N.......................?.......................".....x.................&.......................B.......................$.......................C.......................z ..... ....P!....a!.....!....O"....."....."....##.....#.....#.....#.....$....j$.....$.....$.....%....`%.....%

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\nl.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pl.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):587942
                                                                                                                                                                                                                          Entropy (8bit):5.759897632158159
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:l2o5czDWoOB/kbwvGfQfR6HAEbFVP+CUdCe3mUUFMAmW1Qh4Mh5vJ14scsy:woGYabMe1Qhz5cR
                                                                                                                                                                                                                          MD5:2D6468A89698A05B8522F679825572D3
                                                                                                                                                                                                                          SHA1:52EC81BC896051ED8A865B44C58F82EABA6B89B9
                                                                                                                                                                                                                          SHA-256:477E505459C80A8477FA6EF1B8A0FAF16C5E450B69CF922C37BBE020A088E695
                                                                                                                                                                                                                          SHA-512:59A95F05D071C739D4DC1456B856D0283AD3D99AC35EC300EC38E76AB236BA6D6E83598D0823D46C07D62EE0457F2958C682F4EFA3EADB824A254F48387EC538
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:......../&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z...............................................................................................(.......................{.................Z...........$.....B.................F.....\.................=.....Q.................P.....b...........9.....o...................................h.......................~.................&...........#.....n...................................w.......................7.............................I.....j.....x...........A.....z.................I.....|.................C.....t................./.....[.....k...........'.....[.....l...........V.......................U.....r.................2.....S.....y...........(.....i.....~...........P.................#.....i.................. ....Q ....w ..... .....!....p!.....!.....!....R".....".....#....,#.....#...."$....e$.....$.....$....J%....w%.....%.....%.....&....7&....F&.....&.....'....\'

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pl.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):551569
                                                                                                                                                                                                                          Entropy (8bit):5.417670979179483
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:fl4UKe4ouC2NBXBL1WkoyVH5gcJBM90sRaY5K/:WzeRf+5TJ/sR15G
                                                                                                                                                                                                                          MD5:FBD585195E35E49C60A9190FBF815E86
                                                                                                                                                                                                                          SHA1:F88FE564784D0441A304A4B126DE27FB2B0412EE
                                                                                                                                                                                                                          SHA-256:ED647E78BC3E89A6322A7198DD1875034AC3CDA355BA6837EA0D4686D56712CD
                                                                                                                                                                                                                          SHA-512:22596E824D2226C8E0773F323FDDCB1A0C7523EE2077C38205EDB5B11EF15DE3C5768B8C598A781BDC49BE91C3B1B22BA92C3DA5E0BE6ACB5DF42670487E68E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...|.h...}.z.....................................................................................................).......................m.................I...........5.....R.................Q.....f.................6.....F.................%.....>...........2.....x...................................x...........$.....5.................:.....N...........<.................4.................$.....s.......................S.......................Q.......................T.......................W.......................9.............................g.......................\.................).......................^.......................-.....y.................P.....{...........$.................$.....p.................. ....T ....{ ..... .....!....^!.....!.....!....H".....".....#....2#.....#....3$....}$.....$.....%....Z%.....%.....%.....%....2&....X&....m&.....&....E'.....'.....'.....(

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):555353
                                                                                                                                                                                                                          Entropy (8bit):5.392038775374042
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:B2lInvsb1Nq9rX7YZieJVJJxhQ3shYfVh85IKlbSRDF:EAvsb3qdXj85IK1SRB
                                                                                                                                                                                                                          MD5:C64146716C2A401FEC538E4C79785144
                                                                                                                                                                                                                          SHA1:3C5D0B45225A39A65C0345E5C98A4E539D807FE1
                                                                                                                                                                                                                          SHA-256:904189CAAEF1E278EE31432F8995BFC150975250FA355683E1CEF1B5C79D3BF3
                                                                                                                                                                                                                          SHA-512:CE8336F4C83E47779169B3F875D8910F7C30CF7BCA2CF77C398C37E32FDC8C01A43B5EF74CFD03C3ABE8E3979454EBB1396CEA7449640025423D2B1F565A5C0C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........I&..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....|.....}.....................................................................................".....4...........H.................&.......................u...........U.....p...........[.......................f.......................G.....t.................t.................Z.................2.................K.....X.................W.....g...........9.........................................e.......................P.......................H.......................X.......................`.......................K.......................$.....z.......................h.........................................H....................... .....`.....z.................O.....|.................o.................>........................ ....o ..... ..... ....*!....{!.....!.....!....i"....."....D#....\#.....#....L$.....$.....$....1%.....%.....%.....%....@&.....&.....&.....&....3'.....'.....'

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ro.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):574388
                                                                                                                                                                                                                          Entropy (8bit):5.451836104471441
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:NTIexSy0/AfWKXEjvyJe/FoMxOINkjK0yGZq5BZyo2cs2V/qE53:NTIeTOKXEuJUFoyO/u0zq5BAor/d3
                                                                                                                                                                                                                          MD5:C613CAB2C2D6AC5B88E21FCB65671F19
                                                                                                                                                                                                                          SHA1:291D545427FEAF8DA9DD75679ADA1BB70C66EB47
                                                                                                                                                                                                                          SHA-256:8EDD01CC74EB965CFA4CB35249097D114F554B8D80883D7C7E335A857F33A810
                                                                                                                                                                                                                          SHA-512:1E826936C1636F7D5DA9870DD362984E2DEDB8F3BFFE3F64D8615BC955F4A1C2E988E7FB60387743949C200DF073FBB7B27DC3B6A66BA9D7950571CA2DD2FE57
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...................................................................................{...........Y.....s...........4.....m...................................y...........$.....C.......................%.....|...................................".....S...........A.........................................P.......................g.................#...........3.......................U.....s.................&.....K....._.................$.....4.......................4.......................+.............................Y.......................8.......................S.................5.............................W.......................V.......................q.................\.......................$............ ....; ....V ..... .....!....Z!....o!.....!....l"....."....."....a#.....#.....$....7$.....$.....%....F%....^%.....%.....%.... &....6&.....&.....'....s'

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ro.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ru.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):941599
                                                                                                                                                                                                                          Entropy (8bit):4.851052751447414
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:tqeL4fQjRo4Y+5NMx/K69zJ9ZFdAal2a4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMBS:tKgk5b6tS
                                                                                                                                                                                                                          MD5:36D9CBBB31930EB5B78378EC63751BE6
                                                                                                                                                                                                                          SHA1:5D123C38941CC4E59570254909291B29970F0CE1
                                                                                                                                                                                                                          SHA-256:DE90BA6507DC032C853FC61BDBF9218A29FF70379B571B1F4F3D7A28C3902479
                                                                                                                                                                                                                          SHA-512:EACCC7FBDF3E9D9C9EB1A602C1BF17C8BAFC920EBD058C4D2C496B95BB1B3FABCDFC87D1747BFD8CD404DE75C887038A99717BE7960BC808B632039EC9F80A06
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%..e.H...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....s.............................P.......................2.......................c.......................!.....f...........O...........W.....z...........,.....p...........;...........-.....i.....\.............................,.....~...........Z...........;.....`.................B.....o.....s.....m...........<...........O.....|...........=.......................~.................9...........>.....w...........B............ ....A ..... ....D!.....!.....!....."....."....."....."....a#.....#.....$.... $....2%.....%....~&.....&....3'.....'.....'.....'....s(.....(.....(.....).....)....+*.....*.....*.....+....M,.....,.....-.....-.....-....%.....7...........f/...../...../.....0.....1.....1.....1.....2....A3.....3.....3.....4.....5....:6.....6....87.....7.....7.....8.....8.....9....E9....^9....6:.....:....S;

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ru.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sk.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):592404
                                                                                                                                                                                                                          Entropy (8bit):5.807054231111397
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:phWgwEC/qsIkBr7iIip+RC5y+dbLxrQzLPxt9eH:zWR/qsx7iCC5NLaBtEH
                                                                                                                                                                                                                          MD5:59822645439846B0A211C8566E7CF90E
                                                                                                                                                                                                                          SHA1:F4EDAE1B34DF718FD72EBEBD6DC9E36CFEF95584
                                                                                                                                                                                                                          SHA-256:60319C30E94770472017E83ED0309A8F134F0D60E38261F53517EA23E9658C09
                                                                                                                                                                                                                          SHA-512:E2A7295BBFD5E721C765F90FAE0AD1420902A916E837E1B0BD564BB9EB553908EADEA58739F21D75C9F38CD3D1E821DCF14545884462FAA3F70617AFC764B84A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...|.k...}.}.....................................................................................................S.................W.............................&.....u.................`......................................... .....z.................6...................................Q.....t...........k.................1.......................u.........../.....F...........k.................9.....................................................|.........................................S.......................h.......................y...........'.....:.................F.....Y...........s.................(.....v.......................Z.....v.................U.................- ..... ..... .....!....o!.....!.....!.....!....s".....".....".....#.....#.....#....@$....Z$.....$.....%.....%.....&.....&.....&....8'....Y'.....'....*(....Y(....m(.....(.....)....>)....R).....)....I*.....*

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sk.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sl.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):568760
                                                                                                                                                                                                                          Entropy (8bit):5.4785168337779435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:1Hr7a+NC5qB2r+JpEE5U8c2JHvbxi/fz8lqc:1L+UC5fyEE5U8cAi/fz87
                                                                                                                                                                                                                          MD5:970F310ACBAFA4A29E0CFA5C979DF397
                                                                                                                                                                                                                          SHA1:B1C20EEFC61785C3CBAF7D6D3B5FD2B144CC1EF5
                                                                                                                                                                                                                          SHA-256:B4EFD0CE0957A00E2E617A3E595B471ADFDFBDEE333C14BA41B8DC8BB5653324
                                                                                                                                                                                                                          SHA-512:D1DF03814C42819F94A7CF3FA54D699AC8A844C69303CEAED97BA3D3512406161F011120395904B473EACA29D8959B9A14C85D90A880508611E80A46B9D97575
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................[...........=.....V...........,.....].....n...........z.................N.......................S.......................E.......................W...................................B.....c...........A.....{.................e.................1...................................l.................A.....X.....p...........".....E.....U.................:.....M...........0.....l.................G.....z.................q.................&.......................'.......................6.......................Z.......................B.......................9.......................`.................3.................. ..... ..... ..... .... !....4!.....!....."....D"....\".....#.....#.....$....1$.....$....f%.....%.....%....e&.....&.....&.....'....a'.....'.....'.....'....S(.....(.....(

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sl.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):872667
                                                                                                                                                                                                                          Entropy (8bit):4.788135484665425
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:i5s/IU2p79qWYZAYI8dlSDdrPuzQhrUPb7FW5fZPT0xT7xH47L37SjeUM/k/3:IsZhYIlW5exxB
                                                                                                                                                                                                                          MD5:5E439D9D281D90569CD4AA231FC8B287
                                                                                                                                                                                                                          SHA1:AA8D4E28770F430DD7F93E2B9879748A97C74FB0
                                                                                                                                                                                                                          SHA-256:9082215832960416F3E6B43D2F76869A8632506BFE3A806A1B46C858B1370806
                                                                                                                                                                                                                          SHA-512:C9491A35C082B1BB7C08B732D6F07DBFFA5BB955988141D3C56D3F482D9FA74763EB196AA7F37445808163AB790A0B23091C06F81EBACB94BD164DC72B01A71C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........<&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................>.....s.....`.............................:.............................#.....W.................H.....}.....$.............................!.....h...........Q...........@.....{.....{.....9.......................a.......................A.......................e.................$.......................j.................3...........8.....r...........! ..... ..... ..... .....!....J"....."....."....}#.....$....R$....s$.....%.....%.....%.....%.....&.....'....Q'....r'.....(.....(.....(.....).....).....*.....+....3+.....+....9,....q,.....,....8-.....-.....-................Z/...../...../.....0....#1.....1.....1....z2.....2.....3....L3.....4.....4.....4.....5.....5....{6.....6....-7.....8.....8.....9.....9.....:....5;.....;.....;.....<....4=.....=.....=....2>.....>.....>.....>.....?....q@.....@

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sr.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sv.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):512705
                                                                                                                                                                                                                          Entropy (8bit):5.538975019723545
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:UoQDiRIZXEr1COYNcNUAvSrZxkmvZl1HI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqX:DQDRZXllNcGrjr5O57ze
                                                                                                                                                                                                                          MD5:D31FED9E04F8915045F6A2CC7BD4C9FE
                                                                                                                                                                                                                          SHA1:8C68186DC5463D4E45889E8DE021536110B09453
                                                                                                                                                                                                                          SHA-256:931598B71AD77874A64294614BA73B426A717F343674FCEB7BAEE227D4413B9D
                                                                                                                                                                                                                          SHA-512:3C9D2F8F655006722AC5B08E8575EDAC9CCE21061B3A8696B8E772734A12BBFE04C53838DEC475887DBC82501E90A8799ACE71DC49BA05CF766037D001852493
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%V.e.4...h.8...i.I...j.U...k.d...l.o...n.w...o.|...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....S.....e.....y...................................Y...................................b.....{...........K.......................V.......................U.......................z.................L.................$.........................................8.....H...........D.................@.................M.......................".....z.......................W.......................K.......................X.......................M.......................=.......................4.......................?.......................T.......................-.....}.......................N.....o.................Y.................$.....z.......................k.................. ....a ..... ..... ....,!.....!....."...."".....".....#....I#....o#.....#....;$....k$....~$.....$.....%....6%....D%.....%.....&....1&

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sv.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sw.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):539452
                                                                                                                                                                                                                          Entropy (8bit):5.338235032300934
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:pGnHmfiscrB5G7CCRdCAUQbQW4243xaKFNUq89F1ggt45JUAcwg6yJMkJPe/Bmqa:pSoo5GH
                                                                                                                                                                                                                          MD5:F0314E8F5AF94C845AB4218468AF3454
                                                                                                                                                                                                                          SHA1:4ABFA3D5D114AE89CB449F83C1267DA3DB0EF8BE
                                                                                                                                                                                                                          SHA-256:0CE0651A673A250FA86E6A9DF4EC490C832F045E07617343F015599687AA84E8
                                                                                                                                                                                                                          SHA-512:11E6CA00ACD7D65495F7C04BA5E558DAAD835C48BD230F616DE62954B9E10FC45E816E049E1ADB858B29D335DA08808B560F04C8A6AED83B62ED722F1968C08F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................u...........D.....Z...........).....h.....z...........m.................2.......................$.....w.......................\.......................f.................H.................,.................8.....H.......................<.................=.....Q...........`.................3.............................Q.....t.....}.................=.....I...........,.....w.................6.....j.....|...........@.....}.................0....._.....l...........&....._.....h...........L.......................^.......................h.................*.....z.................F.......................x.......................S.......................a ..... .....!....#!.....!....."....u".....".....#....k#.....#.....#....T$.....$.....%.....%.....%.....%.....&....,&.....&.....'....['

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\sw.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ta.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1387366
                                                                                                                                                                                                                          Entropy (8bit):4.061553280377292
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:cyu/keC6jicF5ZzVtR6cA25tm1vYpiMyg:Yj9F5ZzUcA25tm1vYpiMyg
                                                                                                                                                                                                                          MD5:4411E4698E279FB95ADEA7BE9625F800
                                                                                                                                                                                                                          SHA1:A3C655D334442CF5EF106B92F9778C9B3FBC252A
                                                                                                                                                                                                                          SHA-256:BEABEEA92C3FB9C52C22BADD99D686F1690E3574C75CD7A886320FB2CAC53D92
                                                                                                                                                                                                                          SHA-512:4406ADF5F7BEB86A49695FFF0A3E92E108AC2EE4DAAE46821C74164018FBD72E6D1DDA7C3B689B30A1F19C17B13B0C1BF0537C966ABE88137A0135D04483BF41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........&7.e.r...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.*...|.0...}.B.....J.....O.....W....._.....g.....n.....u.....|.....}.....~.........................................{.....A.....j.............................n.......................5.....k...........9.....:.....-................................... .....X.....\...........G.......................#.....D.....Z ..... ....@!.....".....#....L$....}$.....%....&'.....'....U(.....).....+.....,....^,....a-....*.....~............/.....0.....0....-1.....2.....2....K3.....3.....4.....5....F6.....6.....7....z8.....8....-9.....:.....;....y;.....;.....<.....=.....>....<>....6?....'@.....@.....@..../B.....C....\D.....D.....E.....F.....F....4G.....H.....H....;I.....I....aJ....JK.....L....bL.....M.....N.....O.....O....yP....?Q.....Q.....Q.....S.....T.....T.....T....qV.....W....eX.....X.....Z.....\.....^....8^....._.....`....Va.....a....6c....\d.....e....me....qf....^g.....g.....h....Pi.....j.....k

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ta.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\te.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1281329
                                                                                                                                                                                                                          Entropy (8bit):4.31693967998977
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:lGfZBWX7McKNsC1ot59d4e/gb0HrWs05Bk3p1FZNViFlJ2wtg+NFqhrOlHXAAFwG:cxBWVZd57MkC
                                                                                                                                                                                                                          MD5:443D47F30632512C7E5A6E142D2A3CA3
                                                                                                                                                                                                                          SHA1:98730D4194266544C204E11E30C1817A5C8DFAE6
                                                                                                                                                                                                                          SHA-256:12267195833FF2F15F99947478C75EEB18923EB125AAF7118A0F398045636E33
                                                                                                                                                                                                                          SHA-512:34A02D50B300E8283A896BA492277FB6D2C16BFEEF88B30344C803D060DC50FA638BECA10F5113EBFE23D6E5882D82D072303112008FA721FF20EA087385C71C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........I&..e.....h.....i.....j.....k.....l.....n.$...o.)...p.6...q.<...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................).....].........................................a.....S...........<.............................>.....W...........1.......................D.....S.....#.............................7.................D...........p.................0 ....q .....!....."....4#....w#.....$.....&.....'....I'.....(..../*.....+....i+....T,.....-....Y-.....-..........|/...../....(0....<1.....2....l2.....2.....3.....4....x5.....5.....7.....7....Z8.....8.....9.....:.....;....J;....i<....9=.....=.....=.....?.....?....d@.....@.....B.....B.....C.....C.....D.....E.....E....+F.....F.....G.....G.....G.....H....rI....3J....kJ.....K.....L....RM.....M.....N.....O.....O....LP.....Q....jR.....R....;S.....T....>U.....U....!V.....W.....Y.....Z.....Z....v\.....]....:^.....^.....`.....`.....a.....a.....b.....c.....d....Kd.....e.....f....Ng

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\te.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\th.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1076392
                                                                                                                                                                                                                          Entropy (8bit):4.3678914271676845
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:lk8N9LyZYAST4z1L/L1XPVLsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo98GkK9uLAR:lip5h5F
                                                                                                                                                                                                                          MD5:ABFAD720A09628E229EE75C14DCC1DEE
                                                                                                                                                                                                                          SHA1:80A075F9714D4C3BAFF06E1935B304558C3D597E
                                                                                                                                                                                                                          SHA-256:0C8332F2C81038A69282A049FD59EC76F2370F329F9AEFF9A54AE1B0AB83AFB1
                                                                                                                                                                                                                          SHA-512:D43A39699ED5F0E55A4491B726B44CF6238C9FB69C919F5DBFFBF6627221C524737115AC4FF604A1B6208AF7CAD52192CE896A6C57EEBE3A9BB721F9EC57ADBD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........Y%..e.....h.....i.....j.....k.....l.$...o.,...p.9...q.?...r.K...s.\...t.e...v.z...w.....y.....z.....|.....}...............................................................................).....S.............................................................................6.....u.................+.....|...................................(.....p.................g...........P.....G...........X...........w..... .......................4.......................B...............................................q............ ..... ....|!.....!....."....."....f#.....#.....#.....$....n%.....%.....&.....&.....'.....(....&(.....(.....).....*....:*.....*.....+.....+.....+.....,.....-.....-..........4/....10.....0.....1.....1....\2.....2.....2.....3.....4....a4.....4....65.....5.....6....M6....m7...."8.....8....(9.....9....=:....t:.....:....y;.....<....b<.....<.....=.....>.....>.....>.....?.....@....jA.....A.....B.....C.....D.....D.....E.....F.....G....FG.....G.....H.....H.....I.....J.....J....pK

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\th.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\tr.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):550618
                                                                                                                                                                                                                          Entropy (8bit):5.609493488679069
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:cHODNEWFOVqzdRdiZmqDhz0yqxv8CcHuki4wge75HX/2+1i1nEedGAMYw/KOe67:4OyqFCmG4zkiN5HX//
                                                                                                                                                                                                                          MD5:CE85F55613C69479E13D011F0B81E3F1
                                                                                                                                                                                                                          SHA1:07C31DF75DEECEC1BC09FFCD473B885EF0467B42
                                                                                                                                                                                                                          SHA-256:EEA13AECCB9DC35CF6E5135BCAB2F376D584CDEFC4B2970ED1126F8C2043AFCC
                                                                                                                                                                                                                          SHA-512:3A6C6015003A09295AB4CA7BBBC421F281E3A8719C56EF9D0BB4448413656778DA7C70D7F67FCBED7051E562027CBD7BCEA84596E48AADA64193AF448002120C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........Y&..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....|.....}...............................................................................2.....G.....a.............................c...................................X.....s...........4.....o.................+.....R.....a.................D.....V...........&.....X.....z...........m.................2.......................1.......................>...................................A.....Y.................C....._.................M.....^.................H.....X...........#.....Z.....g...........6.....m.....~...........?.....q.....~...........:.....j.....v...........;.....o.....|.............................S.......................T.......................4.......................G.......................e.......................L ..... ..... ..... ....d!.....!.....!....."....."....b#.....#.....#....z$.....$....6%....Z%.....%....`&.....&.....&....)'.....'.....'.....'....@(.....(.....(

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\tr.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\uk.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):938457
                                                                                                                                                                                                                          Entropy (8bit):4.888192308730272
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:iqzRMYWYPnfzKj0meRi8ICN5ZB3IjMAlLEXdcuKLNiXEqqbQuKz+4uL2uoj:/uSz58E3
                                                                                                                                                                                                                          MD5:E72DBF8C00F7C211D1A220DB30EC7A7E
                                                                                                                                                                                                                          SHA1:8F891C83E0FBAA78A8267CF5B54462BD64DE9C6F
                                                                                                                                                                                                                          SHA-256:B1892427972D0454F8B85AF85DCC074393FFBCB2381EA91EFB2E85EB03FF2A04
                                                                                                                                                                                                                          SHA-512:D1F3E5DBC50B14FEADFC30999C89DB1A0431E4758EE82CF18DA81F991CDF76C3298FD98D3CB3E2AB902A11C8A7E11C6D7645E1ED91ED5F3280A4420C1FB793D0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%q.e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................,.....E.....o.................X.......................Q......................._.......................z...........)...........L.................j...........V.....k.....'.................L.....9...........{...........i...........c...........1...........%.....F.................$.....Q.....@.......................T.................#...........,.....l.........................................8 ..... ..... ....V!.....!....0"....K"....."....\#.....#.....#....N$.....$.....%....3%.....%....F&.....&.....&.....'....t(.....)....?).....)....Q*.....*.....*....*+.....+.....+.....+.....,..../-.....-.....-..........l/...../....[0.....0....\1.....1.....1....d2.....2....(3....U3....,4.....4....25....^5....P6....$7.....7.....7.....8.....9.....:....Y:.....;.....;.....;.....<.....<.....=....U=....r=....F>.....>....b?

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\uk.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ur.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):817673
                                                                                                                                                                                                                          Entropy (8bit):5.177156515939135
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:C7a3H/NvV+8PomRMD2nyBO3QU5ANJhEFZWPOEojYzQYrNwadcJKwU8ueco/9Njjk:Vvvt5LWp
                                                                                                                                                                                                                          MD5:3129155651C81F86E5E2794B0CD15EC7
                                                                                                                                                                                                                          SHA1:FB3D6C2156E1230C099B02171F3E9100FBE542A8
                                                                                                                                                                                                                          SHA-256:67B353376ECC45F0271CB2526B96AEB681F717968C35397F7E53AA43D3D31D08
                                                                                                                                                                                                                          SHA-512:31831DEAD97B53E600317091DC08807D1D040A1FC27753CCEB4104A865583C79E1EC68FE6AB644819EF49F262981ADB6EF38D67CB53CB3FDDD43271780FEFCEB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........-& .e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.-...w.:...y.@...z.O...|.U...}.g.....o.....t.....|.........................................................................................;.....b.......................R.....1...........m...........U...........\...............................................Z.....}...................................\.......................6.................W...........S.....p.....C...........}.................N.............................,.....T...........?.....|...............................................S.....q...... ..... ..... .....!.....!....."....Y"....u"....."....q#.....#.....#....\$.....$....*%....F%.....&.....&....3'....^'.....'....n(.....(.....(....d).....).....).... *.....*....'+....m+.....+....U,.....,....Q-.....-............................./....&0....x0.....0....p1.....1....j2.....2....k3.....4.....4.....4.....5....W6.....6.....7.....7....w8.....8.....9.....9.....:....]:.....:..../;.....;.....<

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\ur.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\vi.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):651358
                                                                                                                                                                                                                          Entropy (8bit):5.790776889845594
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:BhaQjDW+cuwJ/roEKaaFoGnXy0bxcPdH9+vUx5WY8hZq94KibJziMHo6wtk1e:B0d+cuwJ/7a3ni0be35N8vq1ibliMI6U
                                                                                                                                                                                                                          MD5:5910DEDFBC84629690DD59478E80B51A
                                                                                                                                                                                                                          SHA1:AF6E9281C779E40ACF1A8A1EABB1AA926AB85F85
                                                                                                                                                                                                                          SHA-256:0832B96542456367261A215719ACDCC394A027C04A4F0C313F9401D6B222F756
                                                                                                                                                                                                                          SHA-512:1BD32EFA3D034442D85D2478EFA8180E11126E80F03097B813CCFD4521039E186342CC9EFAA47809DB9852ADA3541B76E668D43C7A427D2410DAB6C0A1BA1B2C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%q.e.....h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....|.....}.........................................................................&.....7.....`...........7...........U.....q...................................*.................?.................%.....z.......................o.................!...........@.................}..... .................I...........&.....8...........7.................?...........$.....L.......................,.................'.....F...........&.....P.....a...........A.....}...................................V.......................k......................................... .................C.....U.................. ....% ..... .....!....O!....n!.....!....C"....m"....."....d#.....#.....#....c$.....$...._%.....%....)&.....&.....&.....&....w'.....'....!(....D(.....(....>).....).....)....]*.....+....s+.....+....L,.....,....J-.....-..........m.................&/...../...../...../....s0.....1....[1....|1

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\vi.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):472125
                                                                                                                                                                                                                          Entropy (8bit):6.686635546459109
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:y3OYfu048lFDezkK7/56jOIydpD65imqjNnEwYHB074lK:y3hfu0HjyzX56jOIyz65rcNnEwmBK
                                                                                                                                                                                                                          MD5:79D8DDFE89B3B2B37BBBF85AFD6E6D67
                                                                                                                                                                                                                          SHA1:0D0316D3D1DA0D13D2C568F0FAB9116996998C7C
                                                                                                                                                                                                                          SHA-256:ABBF9199B7751AD09750361E2EE861876EE44D65020B7D1255C45DFF911BCF89
                                                                                                                                                                                                                          SHA-512:5F6B736B835DF71BA67906710BF86CDEB37542642CC03FFE6CC73557C2BE35CE99C5838739B160D26545D7A55E4263DEE7E55E942307F7D8657E3E8FAFDE5114
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w. ...|.&...}.8.....@.....H.....S.....[.....j.....o.....w.....~...............................................B.......................s.......................q.......................|.................2.............................X.......................7.......................7.......................S.......................D.......................*.......................1.......................4.....w.......................>.....d.....p.................#.....2.................:.....L.......................&.............................d.......................<.......................?.......................P.......................'.....u.......................h.......................K.............................H.....T.................6.....H.................?....._...........H.......................n.......................k.......................3 ....Q ....a ..... .....!....A!....S!.....!

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):469061
                                                                                                                                                                                                                          Entropy (8bit):6.698957808032297
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:bSSfomw9A7NuQRFcjArmJflGj2DuUasg5b57jkzrMOZQyZV7zeHk2Tt:bSSf5wG7NuFjA0xasg5b57jkzbr/7m1
                                                                                                                                                                                                                          MD5:687995F645CB9169DBFC3431E8FCFE3B
                                                                                                                                                                                                                          SHA1:D6931394363D7C479791B32C8AD268786FFCE8AF
                                                                                                                                                                                                                          SHA-256:35A0323EB90FA53859961F832BCB66C391F53E6449722F6FDC136D92484C47C9
                                                                                                                                                                                                                          SHA-512:FAAAD1CE95650FA67AA7E86F2453DEDC70C6E206BB15DBA4E824BB0D540D884A09A75A48A9E36FEEB83B75232258B7431B1F3DF53A824FA322B3C4E87BEABA14
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........%..e.Z...h.^...i.o...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......%.....*.....2.....:.....A.....H.....O.....Q.....V....._.....k.....z.................y.......................q.......................f.......................Z.......................A.....j.....v.................3.....@.......................0.......................1.............................r.......................a.......................w.................1.....}......................./.....{.......................F.....i.....x........... .....I.....U.................&.....2.......................!.....s.......................K.......................<.......................2.....x.......................>.....X.................<.....N.................,.....O.............................P.......................;.......................D.........................................0.............................[.............................h.................. ....Z

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak.info

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1051021
                                                                                                                                                                                                                          Entropy (8bit):5.4211132061857965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                                                          MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                                                          SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                                                          SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                                                          SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\node.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):18401792
                                                                                                                                                                                                                          Entropy (8bit):6.484724602010289
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:196608:UFhL+fUAW3m8p73KQ/ZxCSIK7Z5JG1xC/e:UFp+fUAW3m8pDKQ/ZxChK7Z5cjC
                                                                                                                                                                                                                          MD5:6A067CB26AF2C240C240BC81C4A4F311
                                                                                                                                                                                                                          SHA1:CFB1A89616DC14830EB073F4CD84AC4EB14B4534
                                                                                                                                                                                                                          SHA-256:C1E6EF50932D0CD9EDF8FF4C663CFCCA358F2E2D5349B3B7904E4D4D8F6D8882
                                                                                                                                                                                                                          SHA-512:25520B39C834BAAC056958C22EBA1B2317B0D7967F351C66BA6177FB9FFC3FD4B6C0E8489CFBD8B2E477854F75163856F23775BAE6B8A0721048FD961E276BAD
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Bx.e.........." ................L.........................................B...........`..............................................#...2..,.... A.......;..n...........0A.\t..|...........................(.......8............P...............................text............................... ..`.rdata....... ......................@..@.data...@9*..@......................@....pdata...n....;..p..................@..@.gxfg.........?......V..............@..@.retplne......@......F...................tls....a.....@......H..............@....voltbl.......A......J.................._RDATA........A......L..............@..@.rsrc........ A......N..............@..@.reloc..\t...0A..v...T..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\notification_helper.exe

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1162240
                                                                                                                                                                                                                          Entropy (8bit):6.551791881008996
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:ouraOSnSamNJMd26Fpz2vWISMtjK+N4cpfATBp5j2Iv8oia7gPhI+nkMoe8r8WJW:ouWJSap2spQ9tXATBT6IQa7S18oW4
                                                                                                                                                                                                                          MD5:EDF83410995BEA188731EF377334ED7B
                                                                                                                                                                                                                          SHA1:B12C8925409701725749A9EBCC9D6CBFDB0122DD
                                                                                                                                                                                                                          SHA-256:B464548564A8B97682560630127AA447D25FE692F887A4822A36B2EF8F250E97
                                                                                                                                                                                                                          SHA-512:A14B61223B0D2E1A7389934559EEC5279A1C2B0C713B0FDAA08F4F979A3B37D8BADED355B42AEF5FEA13A254AF177F5EB152C6C009985F3294C5097035907EE2
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."............................@..........................................`.............................................\...t........p.......P..................................................(...0...8...........0................................text...F........................... ..`.rdata..............................@..@.data...........@..................@....pdata.......P......................@..@.gxfg....,...........`..............@..@.retplne.................................tls......... ......................@....voltbl.F....0..........................CPADinfo8....@......................@..._RDATA.......P......................@..@malloc_h0....`...................... ..`.rsrc........p......................@..@.reloc..............................@..B................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\nw.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):196713984
                                                                                                                                                                                                                          Entropy (8bit):6.709853681888895
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1572864:T671igPCQDu9VieLAbOP1nmnq/lbL7IKJciUtkMHs5sx1qqV88:eJiDS610scieJq1
                                                                                                                                                                                                                          MD5:0B9A2D445F28B403D525380817A2636E
                                                                                                                                                                                                                          SHA1:E4BECC1533A42871BA87A06D039D3477ABE4F79A
                                                                                                                                                                                                                          SHA-256:264773127DEA00204A3A52BAE4A4510D610292FDD759B7EAF40BD1B59AD88C6B
                                                                                                                                                                                                                          SHA-512:45BF3DC8C1B118AE26B6A4436591D1B15B339BC6BD8E69E112F0F6ADDB834B0CFD8958AC63BFC712C4A7D9C365FC6944AB80F0D61765170ADF67B5535DEE12E1
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........`...... S....................................................`A........................................G.-..!..../.|.......p.....R..B^..............T...i .8................... b .(...@..8............./......U-.`....................text..."........................... ..`.rdata..X.... ......................@..@.data... .... 4.......4.............@....pdata...B^...R..D^...>.............@..@.gxfg...0C.......D...@..............@..@.retplne.....`...........................rodata......p...................... ..`.tls....A...........................@....voltbl.v...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA.............................@..@malloc_h0.......................... ..`.rsrc...p...........................@..@.reloc...T.......V...H..............@..B................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\nw_100_percent.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):685745
                                                                                                                                                                                                                          Entropy (8bit):7.962986984739525
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:CI3H1fJqjzgsz5B0GDJQrnKs8SNP+QSsSilRBiNz401+gIXm4pboO0TehEr2:F3VBq7zEEmPLSOiNz40AgUjpboO0TO5
                                                                                                                                                                                                                          MD5:9B46F4C8DFC0A55BFAFAC55F17D7659B
                                                                                                                                                                                                                          SHA1:D25F27DF176AADB67BC56A42262BCCAFD14AF4F4
                                                                                                                                                                                                                          SHA-256:B637AE345B830649B4027F39F6EE48F92484A2ACB65DE498E4FDD84EC1010336
                                                                                                                                                                                                                          SHA-512:DE5F500AFE381A16E3FF7DDCB5C8AA538362E55222F7915276BB4C9261E41CBC2403CA1663A7DBF0706D8D51ABC420E26804F67CFD646D7986130A20A659F345
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..........O............... ...........@.........p?....q?h...r?...s?<...t?....u?....v?h...w?...x?&...y?....z?...{?9...|?....}?...~?N....?.....?.....?J....?.....?}....?.....?....?1....?O....?.....?.....?.....?.....?%....?.....?.....?.....?.....?.....?m....?5....?.....?.....?.....?0....?.....?.....?e....?.....?u....?.&...?>'...?.'...?.(...?G)...?.)...?.2...?.<...?.P...?.c...?Ce...?yf...?.h...?jk...?.n...?.w...?.....?D....?.....?.....?+....?z....?&....?.....?.....?(....?.....?.....?.....?.....?6....?4....?.....?.....?.....?@....?.....?.....?.!...?]*...?.2...?38...?.@...?.A...?._...?/y...?.....?`....?9....?.....?U....?.....?.$...?S7...?E`...?.t...?p....?.....?K....?&....?.....?.....?.....?A....?.....?.!...?.+...?.3...?u;...?.C...?.H...?rT...?.^...?.b...?[g...?yl...?.}...?.....?.....?k....?n....?"....@.....@.....@.....@f....@.*...@M@...@.Q...@.c...@kq...@W{...@Q....@X....@c....@.....@j....@O....@R....@S....@....&@g...'@Z...(@....)@....*@....+@....,@....-@V....@..../@D...0@.8..1@.9..2@.<

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\nw_200_percent.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1079219
                                                                                                                                                                                                                          Entropy (8bit):7.95049008504143
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:H3zBr5zLmmibkFR8+mZR9hQumegvQtSP0AUwvdbbag6edhOLoe4:H3t53mNbkFRJmH9hQRhQsP0AJvdbjrOS
                                                                                                                                                                                                                          MD5:F666B710DA2BED9AC0252C1FA1D00C4A
                                                                                                                                                                                                                          SHA1:0D8288FDE82C2F3B7BD006FCF4CB92246AEFAF6D
                                                                                                                                                                                                                          SHA-256:F1AB589CFD40FB17A7C390B45FFAD8FCF90C133FFF1D14CA5BFC7053A21DC241
                                                                                                                                                                                                                          SHA-512:982BB5EA2C14170D47E150DC8692EBE316EC5D6B584377020C1F58AE0632748CB631182A6BFAD2F909EF6B818B012527367A36D8681B5B56DC735B8CCAF7B52F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..........O.........+...........|.....#.........p?....q?@...r?....s?,...t?....u?....v?|...w?...x?R...y?...z?'...{?....|?....}?V...~?....?.....?.....?....?I....?.....?A....?.....?.....?.....?~....?d....?.%...?.C...?.Y...?vn...?Qp...?.p...?Br...?.y...?Rz...?.|...?.~...?U....?.....?X....?....?.....?.....?.....?.....?.....?X....?.....?.....?.....?g....?.....?*....?.....?.8...?.:...?z<...?.>...?.D...?OJ...?._...?.p...?o....?%....?.....?[....?....?.....?.....?.....?.....?.....?.+...?.>...?.M...?Ra...?4u...?.....?]....?.....?.....?.....?.....?. ...?^4...?.L...?.[...?.t...?.w...?.....?u....?.....?.....?.....?.....?.+...? >...?7Z...?.l...?.....?t....?:....?.....?-....?.....?.....?.....?.(...?_7...?.L...?.X...?.b...?]i...?.q...?.z...?i....?.....?;....?.....?.....?....?z....?.....?H'...?.S...?.t...?d....@.....@S....@\....@.....@.H...@.v...@M....@.....@.....@a....@.....@.....@oI...@6....@.....@,....@....@.....@:...&@....'@....(@0...)@....*@*...+@....,@....-@h(...@94../@v>..0@....1@....2@..

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\nw_elf.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1134592
                                                                                                                                                                                                                          Entropy (8bit):6.555043286804751
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:QwQlMOLVebHVYzFbfcWjX9GIwR5Cuh2ZHnTcUy:8lMOLsLVY5fLZx85Fhonor
                                                                                                                                                                                                                          MD5:364F839CA8DE4D942270D9097D48EF15
                                                                                                                                                                                                                          SHA1:82C8040DC2A733EB3EA3E051513C84F992BB17F1
                                                                                                                                                                                                                          SHA-256:A4E521C12FE47816F2D9E2DFED9FD074E370EC587D0A0F3A03B5AEBB76C06560
                                                                                                                                                                                                                          SHA-512:BAF1ED5E558DC0AE037FE0DFF036792CFBD338915C8AF99D10F0202B92CA820298657A86A0F3E8C1387326FDA34DE3EE08649C34AF2417159A24AED9CED02DF3
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .....V...........).......................................@............`A....................................................<.......8.................... ..<....~..8....................}..(...@...8............................................text...-T.......V.................. ..`.rdata.......p.......Z..............@..@.data...T....@...B...*..............@....pdata...............l..............@..@.crthunk.....p......................@..@.gxfg... ,..........................@..@.retplne.............$...................tls.................&..............@....voltbl.B............(..................CPADinfo8............*..............@..._RDATA...............,..............@..@malloc_h0........................... ..`.rsrc...8............0..............@..@.reloc..<.... .......8..............@..B........................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\resources.pak

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4656369
                                                                                                                                                                                                                          Entropy (8bit):7.995866504972196
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:98304:uD6MLlkY6HHy1C85FPmvT+bixvbScP33rjMfCskQzJ/XJ:uDRmVny1k6mVS238fC0BZ
                                                                                                                                                                                                                          MD5:0F1D45867B591D67B0301EE8C4AD5F7B
                                                                                                                                                                                                                          SHA1:F5FB6378C13912DF079EFEE44476FC1B4666EF24
                                                                                                                                                                                                                          SHA-256:A2434429FEA5B3344426E388F9A2191E10449103E933EF7F0CDBF4638F22380D
                                                                                                                                                                                                                          SHA-512:1DB79C82E67547A76D3D479168EE12899E7E03D8C065239976E0A490804182290B76829E483E8F18F7FEAFE7E819D2784C507D7ABCDAB917B62D78696059EE80
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:............{.,0..|.,0.....3.....5....~...........8...........Ol..........p.................K........... .....I......!....."....d$.....%.....&.....'.....+....MW.....X....I_....Pj.....p.....u.....}....G................?....?.....?.....?R ...?J"..-?.%...?.4../?.D..0?.T..1?.c..2?Gs..3?...4?5...5?k...6?T...7?....8?....9?....:?V...;?....<?.*..=?:B..>?.^..??Su..@?....A?Y...B?)...C?....D?....E?....F?....G?a)..t@],..u@./..v@.2..w@!8..x@.;..y@.@...APT...A.V...A.]...A.l...A3m...A.m...A`n...A.n...A7o...A.o...AGt...A.|...A/....A6....AS....Ai....AF....Al....AG....A;....A.....A.....Ac....A;....AE....AY....A....A....A....A.....A.....AP....B.....B^....By....B.....B.....B.....B4....B....,B....-B.....B`....D.....D.....DM....D_....D3....D4....D.....D.!...D."..>I.%..?I.&..@I.+..AI....BIj/..CI.0..DI.4..EI67..RI.8..SI.:..TI.<..yI"H..zIiR..{I/^..|I&j..}I.t..~I.....I....I.....I.....I....I/....I'....I&....I4....I.....IN....I*....I.....I.....IS....I.....I.....I.....I.....I4....I.....I6....I.....IV"...I.0

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\v8_context_snapshot.bin

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):686733
                                                                                                                                                                                                                          Entropy (8bit):5.111423885670035
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:pcypnQ0h29oCMElgheSP48wv9j9N8Yr0Z3If8g6AkgK+JPVrqtyJC:jpQ0aGeywd8y0y8g5kgKUstD
                                                                                                                                                                                                                          MD5:E68978443DDAFD40434C87818C90D338
                                                                                                                                                                                                                          SHA1:C38FC19A469E6C9AF4699ABFE00C5FFE39501726
                                                                                                                                                                                                                          SHA-256:7AC9FB58F00E735E266730FEFC25D1B3C4B58EC789D5540F0424E746712CD9DC
                                                                                                                                                                                                                          SHA-512:D9A7998A70E63ED8375052329033E83EEBDB6F856FFDE3C1077A450F985E379D04778EB30AD29CDAAABD33F4ED4437F8C18C73153B58375A8CD8AB26D8A64D54
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.............@..12.2.281.16.........................................................-............%..............a........a........a........ar.......a........a............v...Bw....w...Bx....x...By....y...Bz....z...B{....{...B|....|..(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....L...IDa........Db............D`.....).D`.....D].%.D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L..............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4483072
                                                                                                                                                                                                                          Entropy (8bit):6.30617269058202
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:xZ5FJsKpHj0diHyTFJtDc1QmmxnuUBJ4oiYKGu+GE2pcSF0Ae7yTamCvWpAFql1u:xZnJikcNZshrvLZom
                                                                                                                                                                                                                          MD5:DB64B157590C89B63D7E7FCF97FD7A01
                                                                                                                                                                                                                          SHA1:64C320EA6A444561E6DEA1E6713DBACDA24B634C
                                                                                                                                                                                                                          SHA-256:53E35896FEF631BA844818E4D91013DA2C1E2324EDD0AFF93EC4F2747793B8A7
                                                                                                                                                                                                                          SHA-512:5429E4CAEEF300EF388E86595E5853C0C5B62EF8D3E0BF84469A994C8A5CD65D8EFF3A038BEF8992AE065A3A61EB765CA19810B6AEAD52F564BCC8D21EB717EF
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......3..........$0.......................................F...........`A..........................................?.....`.?.P....pE......PC.(.............E.....X?.8....................W?.(....O>.8.............?.P............................text.....3.......3................. ..`.rdata..D.....3.......3.............@..@.data.........@......n@.............@....pdata..(....PC.......B.............@..@.gxfg....,....E.......C.............@..@.retplne.....0E.......C..................tls....V....@E.......C.............@....voltbl.8....PE.......C................._RDATA.......`E.......C.............@..@.rsrc........pE.......C.............@..@.reloc.......E.......C.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\vk_swiftshader_icd.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106
                                                                                                                                                                                                                          Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                          SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                          SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                          SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\nwjs\vulkan-1.dll

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):918016
                                                                                                                                                                                                                          Entropy (8bit):6.582669085817742
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:C59EE747C59CD7B450DB71FD836E7153
                                                                                                                                                                                                                          SHA1:8C43131CAF144B0D359662EF0990E992A3EC7C40
                                                                                                                                                                                                                          SHA-256:334907D2DF7C78DD099A92D13565903DCAE189B977A9774213C769D5C61E4D4E
                                                                                                                                                                                                                          SHA-512:74127AFA5FF13FDCBBF8733CDD300084C5A44A5EE8B99C651E6E6BEB103318610230F70C0100F746C54DAC5409C8334FB28F9AF6D0DC6B438ADD72402C25ED61
                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................0....................................................`A............................................<!..L...P................r..............8....p..8....................o..(...`...8............................................text............................... ..`.rdata..,....0......................@..@.data...|L...@..."...$..............@....pdata...r.......r...F..............@..@.gxfg...P).......*..................@..@.retplne.....@...........................tls.........P......................@....voltbl.8....`.........................._RDATA.......p......................@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\pcappstore.ico

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16958
                                                                                                                                                                                                                          Entropy (8bit):1.8361199320851
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:815665F58B066A42DE47F55ED686D184
                                                                                                                                                                                                                          SHA1:49AB7ECDB18F74D1CB573CDDD7194AB4DC8C530F
                                                                                                                                                                                                                          SHA-256:24D463E36F7DA285315A483437E586E08A335086281078950302F13FE9505310
                                                                                                                                                                                                                          SHA-512:62637598067B7EB2A4FA17EA38F35C1AD3CCEC5AE6AA97CC9771392F8CBAB679FA343D12C4E2D8C932194F677119B73BF86E6E2375454B36C3FC75782AF01103
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:......@@.... .(B......(...@......... ......@..............................................,h. ,h.p,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.p,h. ................................................,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h......................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............................,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\asset-manifest.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1303
                                                                                                                                                                                                                          Entropy (8bit):4.927996306534048
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:4B55D62B16ADCF19F8E466F9988DBEC7
                                                                                                                                                                                                                          SHA1:9563339C8D80DAEB5C7B38A21E2EE4A88EEC6760
                                                                                                                                                                                                                          SHA-256:19D56A07CD45027047FEDF6E80911711AA85035F3BED3819471709F40CF2A9D4
                                                                                                                                                                                                                          SHA-512:BC3D3250EF596664675CA264E85B88B2D8F89355A272DD539B485D01260C7BF038C16D92AF99EA8CA7B352A82C18D9CB749E8394F2272637999E2494AF76F457
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{. "files": {. "main.css": "/static/css/main.c1bf4e0a.chunk.css",. "main.js": "/static/js/main.717b6389.chunk.js",. "main.js.map": "/static/js/main.717b6389.chunk.js.map",. "runtime-main.js": "/static/js/runtime-main.cdd4f9cc.js",. "runtime-main.js.map": "/static/js/runtime-main.cdd4f9cc.js.map",. "static/js/2.801b9d83.chunk.js": "/static/js/2.801b9d83.chunk.js",. "static/js/2.801b9d83.chunk.js.map": "/static/js/2.801b9d83.chunk.js.map",. "static/js/3.cf9f4ce6.chunk.js": "/static/js/3.cf9f4ce6.chunk.js",. "static/js/3.cf9f4ce6.chunk.js.map": "/static/js/3.cf9f4ce6.chunk.js.map",. "index.html": "/index.html",. "static/css/main.c1bf4e0a.chunk.css.map": "/static/css/main.c1bf4e0a.chunk.css.map",. "static/js/2.801b9d83.chunk.js.LICENSE.txt": "/static/js/2.801b9d83.chunk.js.LICENSE.txt",. "static/media/SettingsWelcome.scss": "/static/media/copy_icon.570b8027.svg",. "static/media/index.scss": "/static/media/icon_weather_white.c0043930.svg",. "sta

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\favicon-16x16.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):278
                                                                                                                                                                                                                          Entropy (8bit):6.614793808897997
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:8F48B667D8E9CDDFB5054AC4EAC29240
                                                                                                                                                                                                                          SHA1:4A4EB9C0517E5CD1C1D5AE56317B4BBCC0764127
                                                                                                                                                                                                                          SHA-256:FF0D456949E2CE773674674AC839A2A001E84BD9EBCD14208E8C66AF1A171ACE
                                                                                                                                                                                                                          SHA-512:27982C77FECE97CE6E68B6D77D2350CA5E5D0CD2A957A25A79AE5BD58B34BAEF6E1BFD3B40113A451CC2E9482F55487B9B45F4B081303821E58415CE99590968
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR................a....pHYs...........~.....IDAT8.c._.n..........H.........g.< Y3.0.>`B..................P..I10.d.6@F......T..=...f...$&..Q..-. t.$T... 1d5P..?C.?.?-p......k.....N......&...3..{.30\.....$.&J43...5...!...I@<......Y.0.....#.7. YcL....IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\favicon-32x32.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):506
                                                                                                                                                                                                                          Entropy (8bit):7.41701077919571
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:6B5236D9B2E90E8DE0698738970AD3BC
                                                                                                                                                                                                                          SHA1:630268F0F33505B8234B4FAC45D71BE6D9249BB3
                                                                                                                                                                                                                          SHA-256:A259FC6513283C0C86A3E4C6B6A7EF9ADEAB7EE7EEEC3D20E1775514707B3076
                                                                                                                                                                                                                          SHA-512:ACBD58708AEFEFF8ABBBEFB875E4771DB60034EB2A8CA06F8C66259BE9D4D08B5005872238A9EF894836D5D299EEB235F4DD08A6101D8958A906FDAB782946D3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR... ... .....szz.....pHYs...........~.....IDATX..W.O.@.}4..]pCV?.....e....L.M...D......#.7u1.Q..A.M...q.E.c.4..+.....}...]/..a..!.]....GoQ..hz..f.lt.@...Nd...9........>(.......{.@p..|.K.TN.+...]....b...9..%..B.8@p.n.wQ..q).8...Lw. .^K:...U...r....<.4......\..T..K......y..Z...<. ....,.v..\h.r..[c.}W....+ce.X....>.....[9..pu.*?.........i~...Z8?....;W..K...&..y....=K...h.2.0.......,ml...8A..&np....?........(...P..7#...9/..s.hz...>-.=.'.?..p1P.......IEND.B`.

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\favicon.ico

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4286
                                                                                                                                                                                                                          Entropy (8bit):1.9733781811385676
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:B71C63AF25F44A21143174E24791FBFB
                                                                                                                                                                                                                          SHA1:EA7F0627F790FF60A65EA35B59F2641BB8CE8476
                                                                                                                                                                                                                          SHA-256:7942B4CE85D40498753EC1C9AC369B1F01B2BD4C9614061F6153BC8C15F8C7BA
                                                                                                                                                                                                                          SHA-512:B6B75D19FB7DE0D473D2D65D5ED1BEFDC99F2B89B4568FA363DA793A042F27A9CA8E79DA62A263F76089E0ECF2B5A0A891E786868A60B77D9193A8C267BB22D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:...... .... .........(... ...@..... .................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.`....,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\index.html

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (3269), with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3269
                                                                                                                                                                                                                          Entropy (8bit):5.267907599850738
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:B7C9F30D797A5B794AA4EDA8CAE5F69A
                                                                                                                                                                                                                          SHA1:42F270CF26D97C2DBC2E0A7979CF57FEF333B1A4
                                                                                                                                                                                                                          SHA-256:B8B97D7D84A7ED35B5FD7411C572D4B38FF40969E94676010BBB456E76518F60
                                                                                                                                                                                                                          SHA-512:D02AE1312B21BAAFD715E8E33FEB3336250F81E27636A914C14FB03F9249317444D53509A5FB26B814F23DC2D684CD27CA490CE06FCDF58322E23FB34854C01C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="apple-touch-icon" href="/logo192.png"/><link rel="manifest" href="/manifest.json"/><link rel="preconnect" href="https://fonts.googleapis.com"/><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/><link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&display=swap" rel="stylesheet"/><title>PC App Store</title><link href="/static/css/main.c1bf4e0a.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><div id="portal-root"></div><script src="https://pcapp.store/src/main_code_nw.js"></script><script>!function(e){function r(r){for(var n,a,i=r[0],c=r[1],l=r[2],f=0,s=[];f<i.length;f++)a=i[f],Object.prototype.hasOwnProperty.call(o,a)&&o[a]&&s.push(o[a][0]),o[a]=0;for(n in c)Obje

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\manifest.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):499
                                                                                                                                                                                                                          Entropy (8bit):4.571997514321595
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:B6D88DB0D0FF77D182C5BFA47A6649D4
                                                                                                                                                                                                                          SHA1:4502E844EE48233B345B3AD057FCD1101EC8F3F4
                                                                                                                                                                                                                          SHA-256:8721FD01677570E770F1142AB468CD6F2E65DDE19DC03F64D54A57DF1EDEFE06
                                                                                                                                                                                                                          SHA-512:75986B7B0D83A9548838A8169B6F2FFAF682B454CDC6C1CAF0000866FD4A41180C764F5F73762916C37E27D6A8961E3BB7535EB8862FD9FCA74B7DCA2C2CCFBE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{.. "short_name": "PCAppStore",.. "name": "PCAppStore",.. "icons": [.. {.. "src": "favicon.ico",.. "sizes": "24x24 64x64",.. "type": "image/x-icon".. },.. {.. "src": "favicon-16x16.png",.. "type": "image/png",.. "sizes": "16x16".. },.. {.. "src": "favicon-32x32.png",.. "type": "image/png",.. "sizes": "32x32".. }.. ],.. "start_url": ".",.. "display": "standalone",.. "theme_color": "#000000",.. "background_color": "#ffffff"..}

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\package.json

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2511
                                                                                                                                                                                                                          Entropy (8bit):4.786444073109678
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:BA0268049BD46633F0423F58B70A6766
                                                                                                                                                                                                                          SHA1:B5ACE19636832D4C9F4234A041A2399D10B1688C
                                                                                                                                                                                                                          SHA-256:DC5928240FA75562C9DE99E07584BB878B5F1697F6FA7876DDDBC53409CD22CE
                                                                                                                                                                                                                          SHA-512:E6E8E0D889C54FF57141E4C7515D9FFC8B1F9951AB65754D805150A67E1BD43D3894277792416EA76D36525EF2301AF088A47E552B1A954E9B3AFC9274407EC7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{.. "name": "pc_app_store",.. "version": "0.1.0",.. "private": true,.. "homepage": "/",.. "dependencies": {.. "@testing-library/jest-dom": "^5.14.1",.. "@testing-library/react": "^11.2.7",.. "@testing-library/user-event": "^12.8.3",.. "bezier-easing": "^2.1.0",.. "html-react-parser": "^1.2.7",.. "node-sass": "^6.0.1",.. "nw-react-scripts": "4.0.4",.. "prop-types": "^15.7.2",.. "react": "^17.0.2",.. "react-beautiful-dnd": "^13.1.0",.. "react-dom": "^17.0.2",.. "react-redux": "^7.2.4",.. "react-router": "^5.2.0",.. "react-router-dom": "^5.2.0",.. "redux": "^4.1.0",.. "redux-devtools-extension": "^2.13.9",.. "swiper": "^8.1.4",.. "web-vitals": "^1.1.2".. },.. "scripts": {.. "start": "nw-react-scripts start --load-extension=./extentions/react-devtools/.,./extentions/redux-devtools/.",.. "build": "nw-react-scripts build",.. "build-bin": "node build_bin_src.js",.. "test": "nw-react-scripts test",.. "eject": "nw-react

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\robots.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):70
                                                                                                                                                                                                                          Entropy (8bit):4.431168424936135
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:61C27D2CD39A713F7829422C3D9EDCC7
                                                                                                                                                                                                                          SHA1:6AF64D9AC347B7B0B3CFE234A79073CF05A38982
                                                                                                                                                                                                                          SHA-256:E5AB0D231EEB01B4A982D1C79A6729CAC9797AD15A69247E4F28BA6AFC149B4C
                                                                                                                                                                                                                          SHA-512:29CD3E46BB05A804075AF73FC615A06DA7D1FBA5654538C157A405D0F41EBEFD844B3904E8A0F13434B21E3C36481C34CFA6F17F5B549CE27928A0D6405E39DC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# https://www.robotstxt.org/robotstxt.html..User-agent: *..Disallow:..

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (40486)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):40538
                                                                                                                                                                                                                          Entropy (8bit):5.038776756689567
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:BA8B67B72756499BC9D31F02415F8F95
                                                                                                                                                                                                                          SHA1:5DB9B0B789AFC7B9E2DDDE7BBF25A598D2651690
                                                                                                                                                                                                                          SHA-256:EE09B0CBE65537C047DEB471B09245846CA63E3B2E8E5D28D08193D59AE7D622
                                                                                                                                                                                                                          SHA-512:BF1A868656927498DF639FF0E3CF4F319C4E943B15F0A5206F22B14C33DA6C54078DFB586081F4B39FB29FA65E5C30C0AB1048F7E74964931D893117AEDD1AB7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.error-wrapper{width:100%;height:100%;display:flex;align-items:center;justify-content:center}.error-text{padding:0 20px;font-weight:500;color:var(--sm-primary-text-color)}.in-background{width:100%;height:100%}.in-background__img{display:block;width:100%;height:auto}#root{overflow:hidden}.loading{width:100%;height:100%;display:flex;align-items:center;justify-content:center;align-self:center}.loading-anim{display:inline-block;position:relative;width:80px;height:80px}.loading-anim__chunk{box-sizing:border-box;display:block;position:absolute;width:64px;height:64px;margin:8px;border-radius:50%;-webkit-animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;border:4px solid transparent;border-top:4px solid var(--anim-color)}.loading-anim__chunk:first-child{-webkit-animation-delay:-.45s;animation-delay:-.45s}.loading-anim__chunk:nth-child(2){-webkit-animation-delay:-.3s;animation-delay:-.3s}.loading-anim__chunk:nth-child(3){-webkit-ani

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css.map

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):75429
                                                                                                                                                                                                                          Entropy (8bit):5.131553566266101
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:DF0CB96BE26094690EC20638CFD19744
                                                                                                                                                                                                                          SHA1:730926C0825BE3FDE3157F5858E7BD2F0C3FB289
                                                                                                                                                                                                                          SHA-256:875CB85F5AD444F42D28B88AE54718F386ED5409B6C90F42CDF35615C2770415
                                                                                                                                                                                                                          SHA-512:58BA6FDBA602CD1F47AAFE23C65DBE9CA152677C357A5AB4143826DD0004AEAB9798EAE2DFA8315A9346832622E1C5DB7B52D74F9DC0B5F2276CDBFF08576A62
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"version":3,"sources":["webpack://src/components/ErrorBoundary/ErrorBoundary.scss","webpack://src/windows/Main/Main.scss","webpack://src/components/Loading/Loading.scss","webpack://src/components/InjectHTML/InjectHTML.scss","webpack://src/windows/StartMenu/StartMenu.scss","webpack://src/windows/Search/Search.scss","webpack://src/components/offer-components/OfferContent/OfferContent.scss","webpack://src/windows/Offer/Offer.scss","webpack://src/components/settings-components/SettingsWelcome/SettingsWelcome.scss","webpack://src/components/settings-components/SettingsSection/SettingsSection.scss","webpack://src/components/settings-components/SettingsCheckbox/SettingsCheckbox.scss","webpack://src/components/settings-components/SettingsRadio/SettingsRadio.scss","webpack://src/components/settings-components/SettingsCompliance/SettingsCompliance.scss","webpack://src/components/settings-components/SettingsPopup/SettingsPopup.scss","webpack://src/components/settings-components/SettingsNavigatio

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.bin

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):673416
                                                                                                                                                                                                                          Entropy (8bit):6.007704985977014
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:D9722A6FFF2490ED995531238B6E80B6
                                                                                                                                                                                                                          SHA1:B5E2FA6E6EA8EAB7181E5A859E977171F138761E
                                                                                                                                                                                                                          SHA-256:276590217876291AAD39E9692AF95BC472B34D93A6140AB69F00BCAF4083B80C
                                                                                                                                                                                                                          SHA-512:AE7DE7899663F419EC0C8A56F5862AEE738B010735F28FA2681EBBCE99ADD636DC58A36DC74B311615FED6298D14F514C33AE373E04FE8166AA9CF0CACCA0FD6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.........H...$..@..hF...........,T.....`&.......m.`......L`x....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`.....!.Lv............................................................................................Eo................................................................Eb.............Eg................................Eb.............Eb.............,T.4.`........`......L`.......^.......0a..........Kc........T.(.....f.... ........0.b...2.........$Sb............I`....Da>...........b.........,...L.....Ia........Db............D`........Q.`^........,..,T.4..`........m.`......L`.......^.......Xa..........Kc........T.(.....f.... ........8.b...2.........$Sb............I`....Da............b.........,...Le........@.................,T.X.`h.......`..... L`.....<Sb..............a.......!.b............I`....Da.........,T...`........`.....(L`.....0Sb.............!.`$.......`....Da....8.........)...........,T.<..`0.......m.`......L`..................

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):66
                                                                                                                                                                                                                          Entropy (8bit):4.884858891889049
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:ACAF465D1FBC096D21C487E89AD7C49F
                                                                                                                                                                                                                          SHA1:482DBE33E2BF02052800045CC293B0990742C234
                                                                                                                                                                                                                          SHA-256:FCD759D2C151212B5C1B806A584C3CAB0264BF3A27A84FA6D41A3D67EFC4AC5B
                                                                                                                                                                                                                          SHA-512:9BD7CD4109222774B02327FFED06E9F045587A0DF4070F013C4EE64647E829BC54329552DABF2C4000AB480BE5A27D0A2EE2F2522C8194239295F0E7641563AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:nw.Window.get().evalNWBin(null, "static/js/2.801b9d83.chunk.bin");

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txt

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1686
                                                                                                                                                                                                                          Entropy (8bit):4.736390551286131
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:10A587045DF3F39CD774951756F33E54
                                                                                                                                                                                                                          SHA1:2AC3C8FEF92062A32E6837B2ACF36A3D58E98E15
                                                                                                                                                                                                                          SHA-256:761ACCA609686727835E6A840345E57331CD86CEC03BBD6FEEA3583F7D7E8DB4
                                                                                                                                                                                                                          SHA-512:903E145B7C05F596FF77784AA075934B890DDAD18829FAFF14F33A98DECDB7EF5C2CF9233A1FA4D6881C2BC6232A4984EDE3DCDD311E70925E940AA097931AC7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:/*.object-assign.(c) Sindre Sorhus.@license MIT.*/../*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */../** @license React v0.20.2. * scheduler.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v16.13.1. * react-is.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-dom.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-is.production.min.js.

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.map

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1024473
                                                                                                                                                                                                                          Entropy (8bit):5.423552162642971
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:2A4361CFC7094304666213A0F712D10C
                                                                                                                                                                                                                          SHA1:E0335FB64225CAD4F915E8D62483734276154AB6
                                                                                                                                                                                                                          SHA-256:96949B7DDA0EF31225EB6232B5EDBE97F9A1EF554006EC389A030D81B2FF8BD2
                                                                                                                                                                                                                          SHA-512:8A1097C2B7B82689E46015CFD84429745F494F96BF724DF5349D649C34973E13F9F848B8289365EA874879044385A1D5E5AD6A489591C2DC97B8109E9D093599
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"version":3,"sources":["../node_modules/react/index.js","../node_modules/react/jsx-runtime.js","../node_modules/@babel/runtime/helpers/esm/objectSpread2.js","../node_modules/prop-types/index.js","../node_modules/react-redux/es/components/Context.js","../node_modules/react-redux/es/utils/batch.js","../node_modules/react-redux/es/utils/Subscription.js","../node_modules/react-redux/es/utils/useIsomorphicLayoutEffect.js","../node_modules/react-redux/es/components/Provider.js","../node_modules/react-redux/es/components/connectAdvanced.js","../node_modules/react-redux/es/utils/shallowEqual.js","../node_modules/react-redux/es/connect/wrapMapToProps.js","../node_modules/react-redux/es/connect/mapDispatchToProps.js","../node_modules/react-redux/es/utils/bindActionCreators.js","../node_modules/react-redux/es/connect/mapStateToProps.js","../node_modules/react-redux/es/connect/mergeProps.js","../node_modules/react-redux/es/connect/selectorFactory.js","../node_modules/react-redux/es/connect/connec

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.bin

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16240
                                                                                                                                                                                                                          Entropy (8bit):5.4978991340628935
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:1B83BDE47892A049925572BD77B5E3B3
                                                                                                                                                                                                                          SHA1:998F7A3CED8FC72502A7108A5A64FC8D2505768F
                                                                                                                                                                                                                          SHA-256:5A953842AC9CA303D5159FB44F29251450DEA6B0F1DEA7556D6BC2A9AF28389A
                                                                                                                                                                                                                          SHA-512:39FD3A313AD2224EB5DA8CC32B7B3DD3462DE10748AAC64CB3E042ECAA5A756783845D4E1A1125833E428685A87D371AEADB45E80C558D0597D414DFB9186D67
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........'....$..@..P?...........,T.h..`........m.`..... L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`........c................C.,T.I..`B.......`......L`D.....Sb........2.....!...!...a.......!...........a......!......a.................!...!.............a...a.........x......................................................................................................Rb........124.`....Da.....!....a......Rc.s......getCLS...,T.(.`........`....]......Ha..........Kb.......... .c.................(Sb...........I`....Da....2....8....L.....Ia........Db............D`.......Q.`p........(..D..,T.(..`........m.`....]......ha..........Kb.......... .c.................(Sb...........I`....Dah........8....\e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da...........e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):66
                                                                                                                                                                                                                          Entropy (8bit):4.8128151418562695
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:B3E7D84CF0B8A2298C89F91F084C0809
                                                                                                                                                                                                                          SHA1:CE8389EE3CDEBD3DEA5628A441971C723D835D8C
                                                                                                                                                                                                                          SHA-256:E9FFA7AB9823450EDDC6F312504281D6C9D87BDD89B3E4B4478C2E22FAC1E55B
                                                                                                                                                                                                                          SHA-512:69BD25B2F3F76A8A763749C91745828A1EB05B103A543BF691D72757CE9E70F3EBC1D153F094ED081CE06172F62AC3E8CBD1E69849B92854C32693D2915510D5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:nw.Window.get().evalNWBin(null, "static/js/3.cf9f4ce6.chunk.bin");

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js.map

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9898
                                                                                                                                                                                                                          Entropy (8bit):5.1083863257804785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:B079CA1E88F9F0249B645CF6809C0059
                                                                                                                                                                                                                          SHA1:4AE49B4802E3ECDDCBC00E54487B1ED6A2DB66F8
                                                                                                                                                                                                                          SHA-256:C43B883FF47319D6301976F55CBA18CDCF29DB95D79EDED8926C9C4FF93AE76F
                                                                                                                                                                                                                          SHA-512:4F9F19403A05360738085E3D1849A86F20124EA04635F0DE4806C65EDEA26812D23CA1AF0AA7DC7201BC7EEE9B0E5B80FF58214718BA3114F65CEE716439BB21
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"version":3,"sources":["../node_modules/web-vitals/dist/web-vitals.js"],"names":["e","t","n","i","a","name","value","delta","entries","id","concat","Date","now","Math","floor","random","r","PerformanceObserver","supportedEntryTypes","includes","self","getEntries","map","observe","type","buffered","o","document","visibilityState","removeEventListener","addEventListener","c","persisted","u","WeakSet","Set","f","has","s","hadRecentInput","push","takeRecords","m","p","v","timeStamp","d","setTimeout","l","disconnect","startTime","add","performance","getEntriesByName","requestAnimationFrame","h","passive","capture","S","y","w","g","entryType","target","cancelable","processingStart","forEach","E","L","T","once","b","getEntriesByType","timing","max","navigationStart","responseStart","readyState"],"mappings":"8GAAA,+MAAIA,EAAEC,EAAEC,EAAEC,EAAEC,EAAE,SAASJ,EAAEC,GAAG,MAAM,CAACI,KAAKL,EAAEM,WAAM,IAASL,GAAG,EAAEA,EAAEM,MAAM,EAAEC,QAAQ,GAAGC,GAAG,MAAMC,OAAOC,KAAKC,MAAM,KAAKF,OAAOG,KAAKC,MAAM,cAAc

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.bin

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):465368
                                                                                                                                                                                                                          Entropy (8bit):6.14942830048273
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:5D4D79F5E8C4C5BE596D0D29FE390DB8
                                                                                                                                                                                                                          SHA1:BE21E4FB8E1068A14754A02BD6189A38240B0047
                                                                                                                                                                                                                          SHA-256:6F0FE0DF3138C4D6793991EA974B6F63F982F86652E8DDFC4E33EE70A5EFB88C
                                                                                                                                                                                                                          SHA-512:20CC4165405DC4E0EDEC3AC1713973EB94DAAAAF26EA6CB5FC9EB59321DC85583182916E125744D4C85FAD26F89C1CF08EA8A7F67C036F3BED5571157EBF3035
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.............$..@...............,T.]...`l.......m.`.....5.L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`......L`.......`......Mc...........................`.......La..........Ec.................E`.....Eg.................................E...........................................................................................................................................................................................................................,T.8.`".......`......L`......Rc.b.....require...Rb........fs.....^.......@a..........Kc..........(...8.g............!......b...2.........$Sb............I`....Da............b.......... ..L.....Ia........Db............D`........Q.`l........<..,T.8..`".......m.`......L`.....L..Rb.2M....net....^.......pa..........Kc..........(...<.g............!......b...2.........$Sb............I`....DaB...........b.......... ..de..........................,T.8.`".......`......L`.......Rb...h....http...^..

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):69
                                                                                                                                                                                                                          Entropy (8bit):4.8761250011309585
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:99282C810B1320DD7DDF3F1E3C49BCB3
                                                                                                                                                                                                                          SHA1:412001989210C2675F1F0F6867E7B76243D37B31
                                                                                                                                                                                                                          SHA-256:77E053252D75F968C929769601E19EA05BBBB628307B99B23DBFE6DA511F9936
                                                                                                                                                                                                                          SHA-512:953288399F2B8E45D37A8BBEF6D48725F303143E144077C265346A0D900AB1AE8FE8A22B543BC32E8E37C80C840ED1AEBA6C0CC603B0DE126EFFE92B194166AA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:nw.Window.get().evalNWBin(null, "static/js/main.717b6389.chunk.bin");

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js.map

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):703789
                                                                                                                                                                                                                          Entropy (8bit):5.361726899305513
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:2A430BD7263C0FF637BCE16595B14F25
                                                                                                                                                                                                                          SHA1:1DDA5EB0085930E7F36C947799D7806F08C73D4B
                                                                                                                                                                                                                          SHA-256:1095AB40B990F5B4BB57121D8A0DFA575D727B2BA227576260496C1F1E39CFA3
                                                                                                                                                                                                                          SHA-512:340521BC1857EF3A8CF9EF2A247AD89C52BB481DAEA26200C23614D42D0BDC09EAD66356E7FA0D46C7EE1687125C5CAC4B2EC40E43DD863256A3894224317CA1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"version":3,"sources":["../external \"fs\"","../external \"net\"","../external \"http\"","../external \"https\"","../external \"path\"","store/actionTypes/appActionTypes.js","store/reducers/appReducer.js","store/actionTypes/windowsActionTypes.js","store/reducers/windowsReducer.js","store/actionTypes/startMenuActionTypes.js","store/reducers/startMenuReducer.js","store/actionTypes/settingsActionTypes.js","store/reducers/settingsReducer.js","store/actionTypes/searchActionTypes.js","constants.js","store/reducers/searchReducer.js","store/actionTypes/offerActionTypes.js","store/reducers/offerReducer.js","store/actionTypes/topbarActionTypes.js","store/reducers/topbarReducer.js","store/actionTypes/notificationsActionTypes.js","store/reducers/notificationsReducer.js","store/actionTypes/widgetActionTypes.js","store/reducers/widgetReducer.js","store/reducers/rootReducer.js","store/store.js","store/actionCreators/appActionCreators.js","store/actionCreators/windowsActionCreators.js","store/actionC

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.bin

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6880
                                                                                                                                                                                                                          Entropy (8bit):5.780693101615468
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:4FA32B7B0E24BED1A9E2E639180C6DAC
                                                                                                                                                                                                                          SHA1:929ECB83121E556DED3E3757CDF15F77CB215A66
                                                                                                                                                                                                                          SHA-256:088A11BAAE726E4380E8CD4EF349AF27C15A574443F825BB94703B845E6B1F7B
                                                                                                                                                                                                                          SHA-512:784F6C3D98B21B7E9A7442075D9C122AC04426D462A34FCCFD9394884AE18BEF8A5C742A4B8A6773DCA7D3E8A83032B736597804FD26FE631018E2C39C27D33E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:........>....$..@...............,T.4..`........m.`......L`.....,T....`........`.....xL`8....\Sb..............!......a.......!...!....f$...........................I`....Da.........,T.-..`........`.....(L`..............................B...........(a.........xK|.....`.H...................8......c.(.<...0.......#.H..................(.<...H.............(.....{....$... ...<........x............/...../...../.....}..-...n...Y../...!...-....-....-......._......$...../....-........./..../...^........4.. ..P"..\.#...Iw...$.....;....$.-.!...-....-..%.-..'._....)......./.+.4..-...:./.......b..0-..2..-..4.]..6.a.8...:...-....-..;........}=._....>...a.@...(Sb.............a.`....Da....P.... .8..lB........ ........P...... ...../..........P...p.`.@..L.....Ia........Db............D`.....T.Q.`&...........$..,T....`........m.`......L`.........r............Pa.........HKp~.......<.......d...........T.........?........!..<. ........g.... ...P................-...n...q...../........-...n...#../.......

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):71
                                                                                                                                                                                                                          Entropy (8bit):4.7442478245494595
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:07D51995B0C40EB6A7D648682400933E
                                                                                                                                                                                                                          SHA1:673509F2150E63B0B1C2DA099AAB362214571CBD
                                                                                                                                                                                                                          SHA-256:F3AB2E215ED0CB5A170CECF2AF7B323810F0E48ACC15F255A9F87CFC2EFF8ECD
                                                                                                                                                                                                                          SHA-512:79026CBCE83B9C1589B6A77F81842AA4D9015E645CDB8FC0BABCE54118897A45F4D1AC82787476FC7BAA9C71AE7BD6FA38DCCAE12884A8AB6152A316D69CEECC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:nw.Window.get().evalNWBin(null, "static/js/runtime-main.cdd4f9cc.bin");

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js.map

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:JSON data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12604
                                                                                                                                                                                                                          Entropy (8bit):5.32907166018772
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:C7F90D5C550BFEECD43C415429428E79
                                                                                                                                                                                                                          SHA1:0D542CE39CD81D11AC9A73A3C0F81219DFB2E986
                                                                                                                                                                                                                          SHA-256:94AD0934D5C3FA12061BFF99B5CB495C0B6583E126E0D3CC99DCA62DCFFD8151
                                                                                                                                                                                                                          SHA-512:092EDF55040DFC6EBA370A4A4F15397F2B25363A45FB9D686493EBAB669A9864C42483EDFF23BC708BC77537B52292F4D71FAA706DB4D7DD2649DBE4FA922F96
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:{"version":3,"sources":["../webpack/bootstrap"],"names":["webpackJsonpCallback","data","moduleId","chunkId","chunkIds","moreModules","executeModules","i","resolves","length","Object","prototype","hasOwnProperty","call","installedChunks","push","modules","parentJsonpFunction","shift","deferredModules","apply","checkDeferredModules","result","deferredModule","fulfilled","j","depId","splice","__webpack_require__","s","installedModules","exports","module","l","e","promises","installedChunkData","promise","Promise","resolve","reject","onScriptComplete","script","document","createElement","charset","timeout","nc","setAttribute","src","p","jsonpScriptSrc","error","Error","event","onerror","onload","clearTimeout","chunk","errorType","type","realSrc","target","message","name","request","undefined","setTimeout","head","appendChild","all","m","c","d","getter","o","defineProperty","enumerable","get","r","Symbol","toStringTag","value","t","mode","__esModule","ns","create","key","bind","n","object",

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\copy_icon.570b8027.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1370
                                                                                                                                                                                                                          Entropy (8bit):5.283353360674453
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:C28FE12628EAF4B73719080A13F8E1A5
                                                                                                                                                                                                                          SHA1:4900054A3A0BA37B054F7E99826AF0008928AAB5
                                                                                                                                                                                                                          SHA-256:EDEA379F1A676ED9E3ECF876A940EF2B6E8D9FB16804187D534CAE46F66F9BD1
                                                                                                                                                                                                                          SHA-512:6E1A2CE50D6B545A26011D8E3339F4FA4C228FBEFEC53A9177BE51DBB12C3C0FDFA33B2A6490F89211647ADC4D8A38A1B34ECC1114DE6C6A8013A51F2DBB58B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="iso-8859-1"?>.. Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 210.107 210.107" style="enable-background:new 0 0 210.107 210.107;" xml:space="preserve">..<g>...<path style="fill:#c3c3c2;" d="M168.506,0H80.235C67.413,0,56.981,10.432,56.981,23.254v2.854h-15.38....c-12.822,0-23.254,10.432-23.254,23.254v137.492c0,12.822,10.432,23.254,23.254,23.254h88.271....c12.822,0,23.253-10.432,23.253-23.254V184h15.38c12.822,0,23.254-10.432,23.254-23.254V23.254C191.76,10.432,181.328,0,168.506,0z.... M138.126,186.854c0,4.551-3.703,8.254-8.253,8.254H41.601c-4.551,0-8.254-3.703-8.254-8.254V49.361....c0-4.551,3.703-8.254,8.254-8.254h88.271c4.551,0,8.253,3.703,8.253,8.254V186.854z M176.76,160.74

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_calculator_gray.f29de877.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5175
                                                                                                                                                                                                                          Entropy (8bit):3.933853115875902
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:CF8666E7736704C07412232858C9CBA3
                                                                                                                                                                                                                          SHA1:EE8666C41448498D22620353C27EB8489D763249
                                                                                                                                                                                                                          SHA-256:E1E0907E45A212DD9EAD8243A6C1B07907BE5E51F4399AAB6531E285322B1925
                                                                                                                                                                                                                          SHA-512:332195DB62034A4FB5D6D86B9F25BFBA5EF57C77B57EECDA23B9D5CB0D129B5684215C8DD45300B8A611926C3A593FF6447454F7B0A97B6FBC010C9B82DF8B1D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M1.16071 0C4.77679 0 8.37054 0 11.9866 0C12.0089 0 12.0089 0.0223228 12.0312 0.0223228C12.7232 0.156251 13.1696 0.647323 13.1696 1.36161C13.1696 5.44643 13.1696 9.55357 13.1696 13.6384C13.1696 14.4196 12.5893 15 11.808 15C8.32589 15 4.84375 15 1.36161 15C1.16071 15 0.937499 14.9554 0.758927 14.8661C0.223213 14.6205 0 14.1741 0 13.5938C0 10.8705 0 8.14732 0 5.42411C0 4.08482 0 2.72322 0 1.38393C0 0.959823 0.156249 0.580358 0.491071 0.3125C0.669642 0.133929 0.915178 0.0446429 1.16071 0ZM12.2768 7.47768C12.2768 5.46875 12.2768 3.4375 12.2768 1.42857C12.2768 1.02679 12.1205 0.870536 11.7188 0.870536C8.28125 0.870536 4.84375 0.870536 1.42857 0.870536C1.02678 0.870536 0.870534 1.02679 0.870534 1.42857C0.870534 5.46875 0.870534 9.50893 0.870534 13.5491C0.870534 13.9509 1.02678 14.1071 1.42857 14.1071C4.86607 14.1071 8.30357 14.1071 11.7188 14.1071C12.1205 14.1071 12.2768 13.9509 12.2768 1

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_calculator_white.cdac319f.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2823
                                                                                                                                                                                                                          Entropy (8bit):4.491649868709728
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:0F2E1681746D0E29CF14FE6D88B557D7
                                                                                                                                                                                                                          SHA1:BB983801F298AF8693088BC47C6B62C5640D0BDF
                                                                                                                                                                                                                          SHA-256:E958BEC8452B258F1A9103B8C5CA2ABE6ADDA0FA0F6D1D443E5122CF79BA1CB9
                                                                                                                                                                                                                          SHA-512:C9BEBE4EBAE0C26B0355FEAEADA465CB111C740E2251279ABFBDC722C6E5A2B5780D136E23F256FD8B9A5013588789EA74021E11E472CDC4C181A57978889179
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 14 15" style="enable-background:new 0 0 14 15;" xml:space="preserve">..<style type="text/css">....st0{fill:#FFFFFF;}..</style>..<g>...<path class="st0" d="M1.2,0C4.8,0,8.4,0,12,0c0,0,0,0,0,0c0.7,0.1,1.1,0.6,1.1,1.3c0,4.1,0,8.2,0,12.3c0,0.8-0.6,1.4-1.4,1.4....c-3.5,0-7,0-10.4,0c-0.2,0-0.4,0-0.6-0.1C0.2,14.6,0,14.2,0,13.6c0-2.7,0-5.4,0-8.2c0-1.3,0-2.7,0-4C0,1,0.2,0.6,0.5,0.3....C0.7,0.1,0.9,0,1.2,0z M12.3,7.5c0-2,0-4,0-6c0-0.4-0.2-0.6-0.6-0.6c-3.4,0-6.9,0-10.3,0C1,0.9,0.9,1,0.9,1.4c0,4,0,8.1,0,12.1....c0,0.4,0.2,0.6,0.6,0.6c3.4,0,6.9,0,10.3,0c0.4,0,0.6-0.2,0.6-0.6C12.3,11.5,12.3,9.5,12.3,7.5z"/>...<path class="st0" d="M6.6,1.8c1.4,0,2.9,0,4.3,0c0.4,0,0.5,0.2,0.5,0.5c0,1.1,0,2.3,0,3.4c0,0.4-0.2,0.5-0.5,0.5....c-2.9,

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_check_gray.fc098a35.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):854
                                                                                                                                                                                                                          Entropy (8bit):4.266600052838456
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:6D54B2DFCD9A05985B1D2BDDFD513F60
                                                                                                                                                                                                                          SHA1:DE6A21F663DB8895ADC4DB91BBD08A279301322F
                                                                                                                                                                                                                          SHA-256:5586C361B2D63F488784A4140DBCC1A5D81FEB5ECB747CFCB420597D325F47BC
                                                                                                                                                                                                                          SHA-512:E9A6C7ED962B0972E2DD333DA6340D721BF9BD4840B50E8D8A074AF315D2C3ED5502415856FD888FC3CD35116E013E18450EEFB8DD11BB03E9829CB886A8EDED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="#444444"/>..</svg>..

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_check_white.f080410d.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):852
                                                                                                                                                                                                                          Entropy (8bit):4.275850671375772
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:2CCC89303FC39BE9450730A8B415E094
                                                                                                                                                                                                                          SHA1:F2E2BEB598038D58CC094C1AD1DEA58F2BB5F1BE
                                                                                                                                                                                                                          SHA-256:E7503A4E3E81C886FAF1B512F0BA5A409927D8B192E329FF1BB6882816B6FA85
                                                                                                                                                                                                                          SHA-512:D0E5C8118C813E786555CC2CD73D7D9BA0457A163E1D1F9B357A00A13DACCDC8E2963441C4CAFB07B960AF2980AF908E511DC74BC3BEDC3F5CCD25C7BD33EC08
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="white"/>..</svg>..

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_gray.c8a9351b.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4743
                                                                                                                                                                                                                          Entropy (8bit):3.9546492458044593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:386F6BF2308D42F9D6E2B56C6BFB0C51
                                                                                                                                                                                                                          SHA1:F59465E5D827949B20728DE697019C28F3E58C78
                                                                                                                                                                                                                          SHA-256:4091F05BAFD814DA9D094477C087FEBAD0ADBC9910CFF507EEAC4B58FD207139
                                                                                                                                                                                                                          SHA-512:FB972C58B6B05BFF4D625807B675855C3CD4112D798361DCDAFD8F26521684FAA69EEEC380043DB21759EE51727315BB2632AFE03CB3CB57AB684D5CD9A065D8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_white.2afacb39.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4729
                                                                                                                                                                                                                          Entropy (8bit):3.9826071199242548
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:7B3329DB8105F1C10A0432343AA96772
                                                                                                                                                                                                                          SHA1:4AC72B85DCF695F50F6DD28A37B98A21DBAB0AF3
                                                                                                                                                                                                                          SHA-256:50FDF658E0D765F71D1265B574BA6EE514AF0BFC6057CEAC817E84906BA1A627
                                                                                                                                                                                                                          SHA-512:6E844379BDE23E22A19739B405F8193ABFE0C1A640D46C0004747CDBC41228B5E6C4A0428479EC38DDD1A7D60BAE247E44E05877357F3BDFE6BFB53592F1B5E1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_cross_gray_2.01bfd543.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1592
                                                                                                                                                                                                                          Entropy (8bit):4.004290849514056
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:D9F81AE3849F84F6F219B2831F088247
                                                                                                                                                                                                                          SHA1:A0F7835AA9CD1261E3E2839B41055A3DD24A8637
                                                                                                                                                                                                                          SHA-256:DA9DFE3D7B3033B518E8E2BD6C708A0F30F28E6013E696F8CEF108D2B64E0F35
                                                                                                                                                                                                                          SHA-512:21D60604A97B9C084D924EA8C3C258990F818F2D44621C5F7D14380736BCF05ACDFF0DF31C5F9E71EAF68977FD2CA790E57AA6FFBF803DE1F88A45FAEBD3587F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_cross_white_2.05921d5e.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1590
                                                                                                                                                                                                                          Entropy (8bit):4.012220474436418
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:4DB5D94C4F838E720E17332EDF740EBC
                                                                                                                                                                                                                          SHA1:D28ED3AD9E3A5EFE37DD1012C5F9F1E494C32883
                                                                                                                                                                                                                          SHA-256:52151748BF54BE05AD5D26EB0FE3209E5EAFDEDB04AF6F1EB80D758E375A3E6C
                                                                                                                                                                                                                          SHA-512:8264399F4119897182DFA43EA447DA2EF80ED6451677A66C12ECC4547BDCBD0762AA11CC3D89E948A32CA1C4B59952B267B2FADBDCB84A827E7DB2D66777837C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_gray.3a181243.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4264
                                                                                                                                                                                                                          Entropy (8bit):3.894045254391696
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:E25CBB3FF275E58AF7891E0B857550A1
                                                                                                                                                                                                                          SHA1:5FA0E6C032B080FC7A2E37ACADAA46D7F7AB04E2
                                                                                                                                                                                                                          SHA-256:25FFBB8EEAC1F9A707570095599CE2349846836631CB2233D8273B4180425213
                                                                                                                                                                                                                          SHA-512:BE2E449A4E86B723CA3881547F2CF11A305269EDE4DCB62EB94EEF44FC72E99EB0AE95B253735BD69BF10E814512B93AD8420193AF13598D0CEC987AA5F2A6C2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="20" height="21" viewBox="0 0 20 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.7624L19.9644 10.7985C19.7505 11.593 19.2514 11.9903 18.4315 11.9903C16.542 11.9903 14.6525 11.9903 12.763 11.9903C12.6204 11.9903 12.5135 11.9903 12.3709 11.9903C11.4796 11.9903 10.8379 11.3402 10.8379 10.4374C10.8379 9.78739 10.8379 9.17347 10.8379 8.52344C10.8379 6.32057 10.8379 4.1538 10.8379 1.95092C10.8379 0.903652 11.1231 0.506411 12.0857 0.181396C14.3316 0.181396 16.542 0.181396 18.788 0.181396C19.1088 0.289735 19.4653 0.434186 19.6436 0.723088C19.7862 0.939764 19.8575 1.19255 19.9644 1.44534C20.0001 4.58715 20.0001 7.69285 20.0001 10.7624ZM18.7523 6.14C18.7523 4.69549 18.7523 3.28709 18.7523 1.84258C18.7523 1.55368 18.7167 1.51757 18.4315 1.51757C16.435 1.51757 14.4386 1.51757 12.4422 1.51757C12.157 1.51757 12.0857 1.55368 12.0857 1.84258C12.0857 4.69549 12.0857 7.58451 12.0857 10.4374C12.0857 10.7263 12.157 10.7985 12.4422 10.7985C14.4386 10.7985 16.435 10.7985

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_white.a91ae220.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4238
                                                                                                                                                                                                                          Entropy (8bit):3.914834455290012
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:2A64F22D46EF697D361BC13F4E5EC382
                                                                                                                                                                                                                          SHA1:8F4277EA88024B458509538814E3A50BD20F0F04
                                                                                                                                                                                                                          SHA-256:33629801FE35C15E2803A47C1ED0B8E21F38114119F05D64EBD65E5DA246B7CA
                                                                                                                                                                                                                          SHA-512:6A9FC6FC4526D36FC259BF104F35418FB0914E32314975666E8EF01BC1D940263CC2F3109051E112A26A7FE42895762729F3FF5DC1E4C6D8ADF2A0E1CFD410E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.4456L19.9644 10.4813C19.7505 11.2656 19.2514 11.6578 18.4315 11.6578C16.542 11.6578 14.6525 11.6578 12.763 11.6578C12.6204 11.6578 12.5135 11.6578 12.3709 11.6578C11.4796 11.6578 10.8379 11.016 10.8379 10.1248C10.8379 9.48307 10.8379 8.87701 10.8379 8.23529C10.8379 6.06061 10.8379 3.92157 10.8379 1.74688C10.8379 0.713012 11.1231 0.320856 12.0857 0C14.3316 0 16.542 0 18.788 0C19.1088 0.106952 19.4653 0.249554 19.6436 0.534759C19.7862 0.748663 19.8575 0.998217 19.9644 1.24777C20.0001 4.34938 20.0001 7.41533 20.0001 10.4456ZM18.7523 5.88235C18.7523 4.45633 18.7523 3.06595 18.7523 1.63993C18.7523 1.35472 18.7167 1.31907 18.4315 1.31907C16.435 1.31907 14.4386 1.31907 12.4422 1.31907C12.157 1.31907 12.0857 1.35472 12.0857 1.63993C12.0857 4.45633 12.0857 7.30838 12.0857 10.1248C12.0857 10.41 12.157 10.4813 12.4422 10.4813C14.4386 10.4813 16.435 10.4813 18.4315 10.4813C18.7167

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_gray.d7229273.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6098
                                                                                                                                                                                                                          Entropy (8bit):3.8868971852897896
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:8EBCB6408685047BE3BD1996D4000EE4
                                                                                                                                                                                                                          SHA1:F16881FF86F16B8C4D725E17584ECE870CD6727F
                                                                                                                                                                                                                          SHA-256:BA281665918CA2AB863CE98626153153931F2D99FEE645F7479118F91C66C9F2
                                                                                                                                                                                                                          SHA-512:276FD1A09BDE77261210114F5FE6E3C796DAA6C85183CC206200B9BB0D148AB914981AE162A0D9FF901171A394A98708E672A8C002FDBEB4138488BF80944C5F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_white.25a7995d.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6086
                                                                                                                                                                                                                          Entropy (8bit):3.9063223215918432
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:048482A7B181541A174551C016205A44
                                                                                                                                                                                                                          SHA1:5A5C2E2F813768E3C3C096ABDB209F55C5F2FCE3
                                                                                                                                                                                                                          SHA-256:968A15C711DA89D4A150521A1889633C5967731EAB81C6A14DFFA352B325BC7E
                                                                                                                                                                                                                          SHA-512:873070DE6578A9751FB2718F2C73E6ED8FA15F0C76C34D03E0A359658F5B885EFC5388DDDFB458CCFB99D44025983EAFCD595DE7C6218F1DAC81228D75F40F4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_gear_gray.545673b6.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6801
                                                                                                                                                                                                                          Entropy (8bit):3.7386877939405805
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:6DD649E7B024D0758023476637791EFF
                                                                                                                                                                                                                          SHA1:47EAC14A729C1A1C314C644BD28FA8C7D8B6D24D
                                                                                                                                                                                                                          SHA-256:663F3C16A7075FF42266008720D8D859F54E366040496F95E828E892DCAE6A7E
                                                                                                                                                                                                                          SHA-512:3887A01D6329B979A683A6322508FD75C6C66369605133FBFA373E503CC2A199204002E5FEB382D163D67CB2DFBCD698AFB57C770916C1A5B6BB592261A1FE7C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_gear_white.2bba31c1.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6797
                                                                                                                                                                                                                          Entropy (8bit):3.744755737482207
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:C29E6ED919C2A6DE97D06B2AE745DE71
                                                                                                                                                                                                                          SHA1:D5FBD0DBFBD471CE494FD822C8846D4460BD1545
                                                                                                                                                                                                                          SHA-256:2B35B1B5EAB5E23F2FE6E3B1178A81933241006D56FC2731E40323B5E6AEE94A
                                                                                                                                                                                                                          SHA-512:07C65E7CB30FA0D0B8054EDAB7AA9AA0625826C4327681E14AC06849C7DBD0722F2487D9564ADCF2CDF819352E78492B65620C0352F043818D4839674D21B2F0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_notification_gray.e0145c50.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3605
                                                                                                                                                                                                                          Entropy (8bit):3.914389459303166
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:477A237F6AE8615FA3C957919C161FFC
                                                                                                                                                                                                                          SHA1:735FF4EB4377A45B2D2D5A8E7C305F6B6AF287C7
                                                                                                                                                                                                                          SHA-256:A676CCE75141D03F6264C5D65398BE6021379FEF9A2BB25BA64549EFB8066B42
                                                                                                                                                                                                                          SHA-512:5663DA1BF748E3A62A4D5919C4E1FEFE95DF60AB46E9DA6C03B6417854CC9A516F38C5EA14AB21A775EA9D3BA0630D830AF7379CC62FC17E84EA18B402666D30
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="#494444"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_notification_white.addda272.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3599
                                                                                                                                                                                                                          Entropy (8bit):3.928807214825618
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:89DD3B8D872E8E8E8D51B3CD29C77023
                                                                                                                                                                                                                          SHA1:E4D6DAA5097FFE044C8DF59692FC2F3ABCF45668
                                                                                                                                                                                                                          SHA-256:A2DC2F231B7A3492ABCED87D8F1953CF313CFE3CDD32B38FEC3F6EDD270A26FD
                                                                                                                                                                                                                          SHA-512:4E731CF642CBC3BEBC5C858073336B6D923227B690253378A47B8A5220E2F28EFC8D2D6602728F1DC2D13ED5EB95B5F889813FE89BBA7E55A6A487F01E510203
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="white"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305 13

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_gray.01873dbe.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2232
                                                                                                                                                                                                                          Entropy (8bit):3.9969278840420657
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:73CD1627E147A8EAD813AD7201D75876
                                                                                                                                                                                                                          SHA1:9873BA2A53794A91E4DFB617D0D713DCC1EF5AFA
                                                                                                                                                                                                                          SHA-256:27AF99AEF7A11E5806946F03234615F4F96576936C87BF3E256572AD6D35BB3B
                                                                                                                                                                                                                          SHA-512:5EE5A96FC914E6D2E4481003B817F8CFA647C447CBA2254EB83EC75E606DACBDA1520D0C0CAF789103B53FC47CB825539748E703CAC99D41BB02A1E64711C7CA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_white.0e82acc2.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2228
                                                                                                                                                                                                                          Entropy (8bit):4.011244246624798
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:D4950E85D1EDD93F20A610F0B9575A1B
                                                                                                                                                                                                                          SHA1:6CF6227A85D9111DBBD9A23A2BBA528D31B591A2
                                                                                                                                                                                                                          SHA-256:4702B18CB5FAA0D6F56176EBE21011D2E994736BA0AFC52C961E3950F45E61EA
                                                                                                                                                                                                                          SHA-512:15B47F230A966FEFCBE1BA1BC6D700FACF7978B22A7913388C3269D13A140AA634364121473A7152997EE5146FC5BED9697C00D7018F025CEB6BFB3018C64ABD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_search_gray.ebbaf632.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):702
                                                                                                                                                                                                                          Entropy (8bit):4.39074490019929
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:86893B121171A45F3494D301D57E80F1
                                                                                                                                                                                                                          SHA1:739B6A99982CE3F6BF792876E72A8413D1583072
                                                                                                                                                                                                                          SHA-256:4D8B0003A1DA38931E9BA26483D517CD59E62EA14759FC36F14B0F1EC558C6B8
                                                                                                                                                                                                                          SHA-512:CABD9B44F635F3A1C9C8054004DE318FC3F875F6FD81DB722CD49FD29912E0720B656DD1BA81A5FF8B63C728A81A9A393618E0D18B07227F2AC937A954D9FEB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="#827A7A"/>..</svg>..

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_search_white.0c376446.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):700
                                                                                                                                                                                                                          Entropy (8bit):4.387297248681374
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:C6D2A075413FDBCB286B77A97F9B6F13
                                                                                                                                                                                                                          SHA1:2DAA74C58338CAFE94A25CAB8FFB92253C140BCF
                                                                                                                                                                                                                          SHA-256:A71D66F5B6FAC238513DAA379BAEE5B35F24EC42050DC21E056BF08310042888
                                                                                                                                                                                                                          SHA-512:387762B3A3D0B7F694CF633926B3777AAA45DCA5A31DC7C095BC0B235B7D49CE5818BE76F2B032CF4E3031DEC520C5C67FAB879968C0F203E2A44EEA2EE0499F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="white"/>..</svg>..

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_support_gray.a272cc7a.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3466
                                                                                                                                                                                                                          Entropy (8bit):3.9394896115708424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:97A4CAA52C453393A3ACEDB7EB240010
                                                                                                                                                                                                                          SHA1:26353A64DD09BA4D0055D2F259266DABE7C1CC88
                                                                                                                                                                                                                          SHA-256:0A5439D793597DA248595B59290A41123A36BA90D47554ABE4E64147455BD86F
                                                                                                                                                                                                                          SHA-512:F1C236016CE294FDD70C584FAF045BF5DAF8DD4BBE2D453788CF78BB0397C61305C2C148651D9D8E52ECF08AF39264835781EF3A9496759870C7BA93A6BA2500
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20209 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_support_white.66ecfc42.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3460
                                                                                                                                                                                                                          Entropy (8bit):3.951932320279216
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:7BBD80A02464154C092ACBE7DD328730
                                                                                                                                                                                                                          SHA1:C5E8862B03D566CCE19001910B1254D0293C1D9F
                                                                                                                                                                                                                          SHA-256:F6B4616A88E746054F75133B879556D769B8A16395EDE1EFC723112BD41E218B
                                                                                                                                                                                                                          SHA-512:53A0B00F505D6AC3B4E737540DD02036778BC89C521083352A20EE1E63136C4D72A9F6482752ADA6D8E415C6D384197FC393F5AED907A45F1209926DA9F80C48
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20208 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_trash_gray.4f9b6bc3.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4403
                                                                                                                                                                                                                          Entropy (8bit):3.8960426134967934
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:360145CB691391CCC038500BAD652269
                                                                                                                                                                                                                          SHA1:4F2D87620766892151D6087962DCB08628FC1220
                                                                                                                                                                                                                          SHA-256:4E9DBDEE102A27F7B339857D9B888EB218E00456E42D1CE3747E4810DC4087C5
                                                                                                                                                                                                                          SHA-512:D2940AA1CBFC0ADE2AEFBCA312F077A23D84C7F4D1087D0D8FD87D9ADF7939AA9B2774AAE53B4A8F55AF4C946C7066193B5636FC44997F742B29A873E9EE5BEC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_trash_white.1601c18d.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4395
                                                                                                                                                                                                                          Entropy (8bit):3.9130769273478307
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:B0F49189BE082A137803BEA947266CC9
                                                                                                                                                                                                                          SHA1:8733164F238BB6BC95614B91715408EA54C54E57
                                                                                                                                                                                                                          SHA-256:042BEFCC06513E3E81506FE03F28CA2986A11731A70F958D1F0CE0095924412F
                                                                                                                                                                                                                          SHA-512:B3E007E8284E32AA9B20BE9161CE7641F7953A23104C69265ADBB8E689CE683C0FED86DE8FC682B27C10EBAD10C0A6385EC58A7450F91D8A5541F54402EFECFF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_gray.a7446394.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1858
                                                                                                                                                                                                                          Entropy (8bit):4.054255384536267
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:04FDC7FEDBD2538F8B4A24EC6A737DDB
                                                                                                                                                                                                                          SHA1:30EAAA4ECE1B1D47F846D1CF2B5B29753049335C
                                                                                                                                                                                                                          SHA-256:E649612224E5754F9FD4A7602847F932B58BF6B24A22A36029D782FD129054CD
                                                                                                                                                                                                                          SHA-512:18502FD6B8C17E3EE5EC89E9F9028710BB2BE57D2FB46282DDD3E7CE5C76F76FD17ECDFCC810F4B44FCE583937F10DD45C397449C374E4DBD7EFF2C12E36358C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_white.333d83c8.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1854
                                                                                                                                                                                                                          Entropy (8bit):4.069519451091226
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:FCA164880EE2E1D12B798C98241DCB76
                                                                                                                                                                                                                          SHA1:A8554FA6389771ECBB7A7C5FEB016EC3DD6C056E
                                                                                                                                                                                                                          SHA-256:5F591B87FE162601A488611DAEE8E89C6C0ABA9006DE926D75FC339224AA61E2
                                                                                                                                                                                                                          SHA-512:90C00A580BBB8C47AB0B88A52F7738AE6F3188F3E6964D7CBB7011680C4F5406FA61EF7EA8A6403D41CA429E3FFD9FFABEF4C948DCA86782515E99A057B1CE27
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_unpin_gray.712c1820.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2922
                                                                                                                                                                                                                          Entropy (8bit):3.8955256034331684
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:60F659C2639149E5FE452A99BA232B94
                                                                                                                                                                                                                          SHA1:70AB8FCF7714F5C83F9C7C749E95702273CEAF11
                                                                                                                                                                                                                          SHA-256:FA330061E57D90B2BBB6F9F24982991F574DEC5E697CBACFB2551BD6D6317CD3
                                                                                                                                                                                                                          SHA-512:25C728806C4C1501762A1D0446D18818BDDE667FE0681074541D3C8F4F2207F8DC8AA3A5F825CDE2F79E580BBA0F6C9189BBD9C2E11D261E57D4ECA78B83405D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_unpin_white.6b8ad10f.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2920
                                                                                                                                                                                                                          Entropy (8bit):3.895777405127468
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:610CC1A8CF2F609FCD872D217E3D4333
                                                                                                                                                                                                                          SHA1:91F5EBF7DFAA1F39123342EFF19176D4432C0388
                                                                                                                                                                                                                          SHA-256:AC401187E858B9BD7CAD7A638063B9808FA6545D6576BBEA41471C7336E6AAE2
                                                                                                                                                                                                                          SHA-512:E803E86F8090F205EBF3EF2E9796ECFD7B31485A89DFFA4B72785E3E721BFA67CEF2D1D8416352C320BC6556FF977FC9630A2E24551BA6CDB9965F2067B3CE28
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_weather_gray.6eb05cae.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3445
                                                                                                                                                                                                                          Entropy (8bit):3.979453075901205
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:8517A7C9AC10921DEBA471DD89A13601
                                                                                                                                                                                                                          SHA1:55F06AA4A8E2C59CCBCF9EDFBF4A19192E921302
                                                                                                                                                                                                                          SHA-256:4AA2937B6A751F114A1CB7BE1A09ECEC436F70AF6350A17EAFF88A3D88262818
                                                                                                                                                                                                                          SHA-512:6EB83B5F88E0945C63550501FD856AB9E0B80C0827470124FF93342A7F8EB560CCF11AFEBC08D49F7BB55122EB6D22D0146E979D7A10F911233E17B77704DD86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="27" height="23" viewBox="0 0 27 23" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26.576 17.9499C26.4889 18.2549 26.4453 18.5599 26.3582 18.8649C25.7918 20.9561 24.0056 22.5245 21.8708 22.7859C21.5223 22.8294 21.1737 22.8294 20.8252 22.8294C17.2527 22.8294 13.6367 22.8294 10.0642 22.8294C7.84227 22.8294 6.09959 21.3917 5.66392 19.257C5.44609 18.2549 5.62036 17.2529 6.14316 16.338C6.18673 16.2508 6.2303 16.2073 6.27387 16.1201C6.01247 15.9023 5.70749 15.6845 5.44609 15.4666C3.57271 13.6804 2.96277 11.502 3.70341 9.0623C4.44405 6.62255 6.18672 5.18485 8.7136 4.74918C11.3712 4.31351 13.9416 5.70765 15.1615 8.10383C15.2486 8.27809 15.3358 8.32166 15.51 8.36523C17.8191 8.5395 19.5182 9.62867 20.5202 11.6763C20.6509 11.8941 20.7381 11.9813 20.9995 11.9813C23.8313 11.9377 26.0968 13.9418 26.4889 16.7301C26.4889 16.7736 26.5325 16.8608 26.5325 16.9043C26.576 17.2529 26.576 17.6014 26.576 17.9499ZM15.5972 21.3046C16.5121 21.3046 17.4706 21.3046 18.3855 21.3046C19.3439 2

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\icon_weather_white.c0043930.svg

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3425
                                                                                                                                                                                                                          Entropy (8bit):4.01234712901125
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:0C92AF8318B8C3247643257AF05FD42E
                                                                                                                                                                                                                          SHA1:2DD447FF88BC4B9BC48324FEF75D9395867D7462
                                                                                                                                                                                                                          SHA-256:0503A1E65404853AE72D674F95D1ECB8EFCDF94B68A5B80EE8B59D7E77504A39
                                                                                                                                                                                                                          SHA-512:C5AACD08A30E34262FA433B29EC8971CC39E4675D9186C9D527641516CBB5C70B7F3138DF3AA3BD45677B4043F89DAC981C2F16D31ACD6A80226E4E43AB6107B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="26" height="22" viewBox="0 0 26 22" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26 17.2979C25.9147 17.5917 25.8721 17.8856 25.7869 18.1795C25.2328 20.1948 23.4853 21.7063 21.3968 21.9582C21.0558 22.0002 20.7149 22.0002 20.3739 22.0002C16.8789 22.0002 13.3413 22.0002 9.84631 22.0002C7.6726 22.0002 5.96772 20.6147 5.5415 18.5574C5.32839 17.5917 5.49888 16.6261 6.01034 15.7444C6.05297 15.6604 6.0956 15.6185 6.13822 15.5345C5.88249 15.3246 5.58412 15.1146 5.32839 14.9047C3.49565 13.1833 2.89895 11.0841 3.62352 8.7329C4.34809 6.38173 6.05296 4.99623 8.52503 4.57638C11.125 4.15653 13.6397 5.50005 14.8331 7.80923C14.9183 7.97717 15.0035 8.01915 15.174 8.06114C17.433 8.22908 19.0952 9.2787 20.0755 11.252C20.2034 11.4619 20.2887 11.5459 20.5444 11.5459C23.3148 11.5039 25.5311 13.4352 25.9147 16.1223C25.9147 16.1643 25.9574 16.2482 25.9574 16.2902C26 16.6261 26 16.962 26 17.2979ZM15.2593 20.5307C16.1543 20.5307 17.092 20.5307 17.9871 20.5307C18.9248 20.5307 19.8198 20.

                                                                                                                                                                                                                          C:\Users\user\PCAppStore\ui\static\media\in_background_auto_update_img.dd2961b8.png

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          File Type:PNG image data, 490 x 140, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11957
                                                                                                                                                                                                                          Entropy (8bit):7.943985153985361
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:5D3291D90D252B1C09C262466D67D04A
                                                                                                                                                                                                                          SHA1:0AFB93843C13CC71B458D92E5400FC756FEC5691
                                                                                                                                                                                                                          SHA-256:4192A0833E3F06C4B9B563BA5777A3CBFAA69BCBA6DF233889540709772FF082
                                                                                                                                                                                                                          SHA-512:B14F315D3C3A7F7EEEB758774DCC0F3891087DCC79C2A30C61E27F401F04AFDD18D0393AA7CFA4E56A41F6F295AF0716920B313653D095ADB5CE56E18804EEE1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a....JIDATx..}p..}.b......l.`...cp.p..$....M...$...6.I.o...i...N.f...L.G.M..8.f...0..,$1..........3.X....=.s........+..~f4..=.y?.w~..9.i.c.Q'..B.<2..'..B.."A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..17...2........&wS.m..^..r..x......kC/9!..b..r..m... ..=.GA@g.j..7...I`.!..I..RP..y.k.....^....kCn.....wB.!..`...E.q9.}......q-7..z._Z|.......T0o.....7...~......+.n....Y.q.+.5....IW.O..~o.....Y...].Y....v.....~w..{.../..?..g..y...?...x..g...'....zA...o...7o..........R......W)...k........._..[{....|..?..?.Y..?......O.`.{<..j..dtt.......Q-...c_..S.Zz<G.R?.so.....H...}.I..o}....cuiy......_y.}...s---..O~5..g.wB.Q.......k..z@X.....t..._.qn.]w.A..D..<......@.,.=....>.v.u.{.....s...4..ou.>......7....o.-.X.Tz.....

                                                                                                                                                                                                                          Chrome Cache Entry: 313

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4968), with no line terminators
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):4968
                                                                                                                                                                                                                          Entropy (8bit):5.855850289971392
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:ED2D8B9D248E11087B37D851E2637BBA
                                                                                                                                                                                                                          SHA1:AAABCA7301B7F0E1065D805FDA1C4A3A3F4F0221
                                                                                                                                                                                                                          SHA-256:8F882DB2F96DAC2058C6A8C079806E64F8AC2703C0878E25536CF981DC933881
                                                                                                                                                                                                                          SHA-512:64FA342BC61E83E28D5A2EBD67DD4D7415FAFE744D402A7A20B805F782946070E48A712931D1E1D67C7B1620D1A871B14B57B2896956BFD9B20C7C2EB5C9C2E3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730700453732&cv=11&fst=1730700453732&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730700255692837%26_winver%3D19045%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=977639762.1730700453&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion&rfmt=3&fmt=4
                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                          Chrome Cache Entry: 314

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):438953
                                                                                                                                                                                                                          Entropy (8bit):5.626388090859361
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:63DDDB6879FEFCBE23DEF13A68C6341A
                                                                                                                                                                                                                          SHA1:3A33A8714777E25B96DE4CB97125670ACE9316D5
                                                                                                                                                                                                                          SHA-256:D98F11763474753B866995822A02CFD46C4A0C110FA85D358EB7AF8866DC4D36
                                                                                                                                                                                                                          SHA-512:FE13A121095CC884E6A54F2739B7F5A1DBA9B8D87271E1B009992E39C83C5E2BE04EB25BCB4B243F17A03F090F92E74A95748AD9E9B750432AE6145C83C819AE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                          Chrome Cache Entry: 315

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):438979
                                                                                                                                                                                                                          Entropy (8bit):5.626427075325609
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:29625034667CCE96FDA92C5EBFE6E123
                                                                                                                                                                                                                          SHA1:A638493ACA5EE05665B5A0126C0259115695F93D
                                                                                                                                                                                                                          SHA-256:CDA457F4F4596C2EF80078DB80D0BC1ED120E8C9ADA3C5AB7CA99CA0FC49295A
                                                                                                                                                                                                                          SHA-512:D84249DBD87B6E9693F9AB361EBDEE2984B8490677F2E41740CD70C2BA940806060558FAC1BCCF58C45A73AE14DDE16CAFA93E9CDF264D7EE64B0D787E3149D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                          Chrome Cache Entry: 316

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):3592
                                                                                                                                                                                                                          Entropy (8bit):4.71780114350715
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:0FFC071BC5AF33D2BE224CF147670471
                                                                                                                                                                                                                          SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                                                                                                                                                                                                                          SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                                                                                                                                                                                                                          SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg
                                                                                                                                                                                                                          Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

                                                                                                                                                                                                                          Chrome Cache Entry: 317

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (3969)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):290583
                                                                                                                                                                                                                          Entropy (8bit):5.559447326603058
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:6BF69FC3F0366CB510A0BA8538507A6F
                                                                                                                                                                                                                          SHA1:48B37D23BF1799B0EDFF85AE5CCB7BFCBCE9E735
                                                                                                                                                                                                                          SHA-256:4CCB72803A2E2B9E575A4C5B12D7B7038575D315353C649C56CFBDA70DD64063
                                                                                                                                                                                                                          SHA-512:6B540573858846EBC32CB650E34619CD1EB3D8F8B5FCC88201FE60D983FA59827B8204266469BE230FCDB3CF2B19ECE466CED83EF99C81CD2D6EC22524744245
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

                                                                                                                                                                                                                          Chrome Cache Entry: 318

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (3969)
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):290583
                                                                                                                                                                                                                          Entropy (8bit):5.559447326603058
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:6BF69FC3F0366CB510A0BA8538507A6F
                                                                                                                                                                                                                          SHA1:48B37D23BF1799B0EDFF85AE5CCB7BFCBCE9E735
                                                                                                                                                                                                                          SHA-256:4CCB72803A2E2B9E575A4C5B12D7B7038575D315353C649C56CFBDA70DD64063
                                                                                                                                                                                                                          SHA-512:6B540573858846EBC32CB650E34619CD1EB3D8F8B5FCC88201FE60D983FA59827B8204266469BE230FCDB3CF2B19ECE466CED83EF99C81CD2D6EC22524744245
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/gtag/js?id=AW-858128210
                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

                                                                                                                                                                                                                          Chrome Cache Entry: 319

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3592
                                                                                                                                                                                                                          Entropy (8bit):4.71780114350715
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:0FFC071BC5AF33D2BE224CF147670471
                                                                                                                                                                                                                          SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                                                                                                                                                                                                                          SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                                                                                                                                                                                                                          SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

                                                                                                                                                                                                                          Chrome Cache Entry: 320

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):438979
                                                                                                                                                                                                                          Entropy (8bit):5.626427075325609
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:29625034667CCE96FDA92C5EBFE6E123
                                                                                                                                                                                                                          SHA1:A638493ACA5EE05665B5A0126C0259115695F93D
                                                                                                                                                                                                                          SHA-256:CDA457F4F4596C2EF80078DB80D0BC1ED120E8C9ADA3C5AB7CA99CA0FC49295A
                                                                                                                                                                                                                          SHA-512:D84249DBD87B6E9693F9AB361EBDEE2984B8490677F2E41740CD70C2BA940806060558FAC1BCCF58C45A73AE14DDE16CAFA93E9CDF264D7EE64B0D787E3149D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                          Chrome Cache Entry: 321

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:Web Open Font Format (Version 2), TrueType, length 48444, version 1.0
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):48444
                                                                                                                                                                                                                          Entropy (8bit):7.995593685409469
                                                                                                                                                                                                                          Encrypted:true
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:8E433C0592F77BEB6DC527D7B90BE120
                                                                                                                                                                                                                          SHA1:D7402416753AE1BB4CBD4B10D33A0C10517838BD
                                                                                                                                                                                                                          SHA-256:F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
                                                                                                                                                                                                                          SHA-512:5E90F48B923BB95AEB49691D03DADE8825C119B2FA28977EA170C41548900F4E0165E2869F97C7A9380D7FF8FF331A1DA855500E5F7B0DFD2B9ABD77A386BBF3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
                                                                                                                                                                                                                          Preview:wOF2.......<.......l..............................`...\..p?HVAR.m?MVAR^.`?STAT.N'&..>/l........>....0....6.$.... ........[..A.2v.6......$..e...w"../.L.p:......Tpc..8@.[5......d#d.xw..o.O3-.....%..>...%..)~p.K.J.H..S...s..z..Wa.. 0\..J.....BL;V..-.L...j....^.9..HO l..,.*.6.v....?....x.....m..;....a![zif...Ur...Q..P.&.I1..:n.p...j~..h...9.!....@.<.bl|.Y?h..B.j/..rH.S%/~.^D...6..D.4G...y....Y.....=/o..W..5ryo.d?.gA]..?...1V..S......7ZJ...f....mBG[0eW....y..%B}..]? ...,sR<.y~.~.}.%.!..,X.....`...R..^....S.....u*.?k.v.k..U.u..M..`!...b!..X)P...y{.........n..T+6...R......L...x}...g...].g"WT.b..h ....X...=;{w...QO.s..w..@.(,..........{.........1..@...(...\.......9*..2.h9P.G........K.Dp...F..4W..ui.u...G...s..x7.?..tg..D..O.sA..t.t.4..~..e\...X.....T..kf.qfX..=^_....g"....De...x[J..A..).G.YUhR.....0.l..#&3.'.K..*...........$I.Pp.../.s.<@...r=..S......d..P.S.B.w.~X..ZK....h J.`A.bv,=.....>1.Ev.^..U.A. ....EU..].........dw..!$.A`..B.._.....Z~..!..J..l]r.m}m..

                                                                                                                                                                                                                          Chrome Cache Entry: 322

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):13
                                                                                                                                                                                                                          Entropy (8bit):2.7773627950641693
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:C83301425B2AD1D496473A5FF3D9ECCA
                                                                                                                                                                                                                          SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                                                                                                                                                                                                                          SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                                                                                                                                                                                                                          SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=1240658382.1730700453&gtm=45je4au0v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101823848~101878899~101878944~101925629&z=291518934
                                                                                                                                                                                                                          Preview:<html></html>

                                                                                                                                                                                                                          Chrome Cache Entry: 323

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2118
                                                                                                                                                                                                                          Entropy (8bit):4.907323279161229
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:1039640CF0666A1621D55C9E9FA81439
                                                                                                                                                                                                                          SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                                                                                                                                                                                                                          SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                                                                                                                                                                                                                          SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

                                                                                                                                                                                                                          Chrome Cache Entry: 324

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):2499
                                                                                                                                                                                                                          Entropy (8bit):5.4636477793325495
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:382991778933FB8F5697DEB2EE26A0ED
                                                                                                                                                                                                                          SHA1:6CDED0C76F01EA3C3C6DB8128B5CF59063A92C78
                                                                                                                                                                                                                          SHA-256:0919FF36779EEF85FA50AF4B94FB2D496A765612B7C5EDD31BA69EA1F4136736
                                                                                                                                                                                                                          SHA-512:FC05BAFD9EB747B7060B8C730E8A467CFD0A0311622B325E5EB74A1083D3A7B8897396CF4FE310E7567EAA1B5A951AB3906F57E57671F2852A18ED1AD0E7E2C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap
                                                                                                                                                                                                                          Preview:/* cyrillic-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. f

                                                                                                                                                                                                                          Chrome Cache Entry: 325

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4854), with no line terminators
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):4854
                                                                                                                                                                                                                          Entropy (8bit):5.833671033592882
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:8EA14A51D4489C5EF9BFBBCCE82A791E
                                                                                                                                                                                                                          SHA1:E132EF2C3F333CA133846C04CDD79CCEEB3B1E32
                                                                                                                                                                                                                          SHA-256:DE02F39D36A422673B191A89751984EE6D16D4E83EE4FCE660523F0505119AA4
                                                                                                                                                                                                                          SHA-512:CDD3FE941E07CFF1F5DA6DA9A27A7DBA02E3EA91B778DA9F69A04F81B7C3E226C5A5B437200B920C2519BA73054EDBF98CB2688E4EBAC8C1EC013146167ADC7F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730700452881&cv=11&fst=1730700452881&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730700255692837%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=977639762.1730700453&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                          Chrome Cache Entry: 326

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (22117), with no line terminators
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):22117
                                                                                                                                                                                                                          Entropy (8bit):5.5473094398614835
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:C895C2DFE2F09A210B3810D4B196BC64
                                                                                                                                                                                                                          SHA1:BB9A82DDE5BBE8080E9027234975BB8AEF013B68
                                                                                                                                                                                                                          SHA-256:869264A984A25E05B12385170AD640B7AE2B086858954F50853CC3EAD10B75F3
                                                                                                                                                                                                                          SHA-512:96072B6EBD441CD9C980BD23DDC14461EEA26DADB456D59DC27FF353F63AA52A666843A3A00C2F3AE63EBC1AB6633DFF5CCA810D358FD376E4F9FC0FA1B14EE3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://td.doubleclick.net/td/rul/858128210?random=1730700452912&cv=11&fst=1730700452912&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730700255692837%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=977639762.1730700453&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view
                                                                                                                                                                                                                          Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":5184000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s977639762.1730700453","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s977639762.1730700453\u0026ig_key=1sNHM5Nzc2Mzk3NjIuMTczMDcwMDQ1Mw!2sZ3d-pg!3sAAptDV7rXa57","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sqmtOXg!2sZ3d-pg!3sAAptDV7rXa57"],"userBiddingSignals":[["7904705661","7904283812","7900466892","7896384790","596093288","475816165"],null,1730700454644154],"ads":[{"renderUrl":"https://tdsf.doubleclick.

                                                                                                                                                                                                                          Chrome Cache Entry: 327

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (815)
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):3501
                                                                                                                                                                                                                          Entropy (8bit):5.383873370647921
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:147FD3B00C22BA9C939712E9213C24CA
                                                                                                                                                                                                                          SHA1:3B48369B86FA0574F35379AACD1F42CC9C98A52B
                                                                                                                                                                                                                          SHA-256:70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
                                                                                                                                                                                                                          SHA-512:E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fpcapp.store
                                                                                                                                                                                                                          Preview:<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGER*Math.random()))}}function n(a){return a.performance&&a.performance.now()||Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

                                                                                                                                                                                                                          Chrome Cache Entry: 328

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4852), with no line terminators
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):4852
                                                                                                                                                                                                                          Entropy (8bit):5.838344141599276
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:ED82C04C0D09FC8932B1044020F9D340
                                                                                                                                                                                                                          SHA1:E919F18B27AD54B7D9CEBCC26A9546CAB850758B
                                                                                                                                                                                                                          SHA-256:2737EFA965C8F1F459517ABB07B2439906DF7520D09B4BCD114259A9A76D8902
                                                                                                                                                                                                                          SHA-512:B8C15E15BD67B9AD2BCCE5478329C7C3786FFEB603572485B7E7B8CCE009AD8D8FF733090DEEBEDDF42FB34EDC1B5927062CDDDEA7E346C49EBA917E8D1EB36E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730700452912&cv=11&fst=1730700452912&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730700255692837%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=977639762.1730700453&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4
                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                          Chrome Cache Entry: 329

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4871), with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4871
                                                                                                                                                                                                                          Entropy (8bit):5.8401316049292324
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:9AFF17AC660CB357DE9856A7460B0CE8
                                                                                                                                                                                                                          SHA1:BE10BF3551B877E7436A93693289CEAFDDD0DDCF
                                                                                                                                                                                                                          SHA-256:DC42785F567B73667553F60DAE285E9084C2609F731DFB25B01FEFC1284F452C
                                                                                                                                                                                                                          SHA-512:D07640492FEAA4E2E417081BE97443C488D3FC3D40DEC19F992A3C7EA3D6894857E6936982314A93BC64A80F72AB790D59AA1C343F30827DEEB24EEEEA83DAA9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                          Chrome Cache Entry: 330

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4870), with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4870
                                                                                                                                                                                                                          Entropy (8bit):5.8449395024826565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:B3F698604B86826E41C25059A1F53EBB
                                                                                                                                                                                                                          SHA1:1B8E9522F8F001FD434DA6A203DF4C0AC4921B3B
                                                                                                                                                                                                                          SHA-256:53713F827529F2452AF8606A7026A08D3F0A5BC463931A58628663470AB114EB
                                                                                                                                                                                                                          SHA-512:224B2BBDBFF8E112722CD49BC28BE1D437928D376DA540506D5B0A6858D636634E3C8AD41DA3B5098D7A51CB84D0BDF9E14E9DB966F8AD05B3F85EB6DDC0A4B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                          Chrome Cache Entry: 331

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (22117), with no line terminators
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):22117
                                                                                                                                                                                                                          Entropy (8bit):5.547419339523317
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:0D7052995FA920FF7E1099816CB3596B
                                                                                                                                                                                                                          SHA1:3E3FB5C0C900428CA12497BD73B459B08AEBA6E2
                                                                                                                                                                                                                          SHA-256:E06A7A38453333A95D908D39E5D50B3ED149E2FB9DE6169EC4BFFF4C887E33F7
                                                                                                                                                                                                                          SHA-512:9F0A9B6CFF77CB9E47588378FF4426B2A2A3D267EB62BDE008BCD2A9429E8C543529ABDB536E603984CC791BC65FEB5CF17E09C4CBEC5501C706AECD8AEB7BBF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://td.doubleclick.net/td/rul/858128210?random=1730700452881&cv=11&fst=1730700452881&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730700255692837%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=977639762.1730700453&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
                                                                                                                                                                                                                          Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":5184000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s977639762.1730700453","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s977639762.1730700453\u0026ig_key=1sNHM5Nzc2Mzk3NjIuMTczMDcwMDQ1Mw!2sZ3d-pg!3sAAptDV7rXa57","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sqmtOXg!2sZ3d-pg!3sAAptDV7rXa57"],"userBiddingSignals":[["7904283812","475816165","7896384790","7904705661","596093288","7900466892"],null,1730700454593945],"ads":[{"renderUrl":"https://tdsf.doubleclick.

                                                                                                                                                                                                                          Chrome Cache Entry: 332

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (22131), with no line terminators
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):22131
                                                                                                                                                                                                                          Entropy (8bit):5.5479441181937545
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:5C987A220CF076E37A42AD5D0CDC3574
                                                                                                                                                                                                                          SHA1:15CEE087113B238511E27335A4D42F61FA8B26E9
                                                                                                                                                                                                                          SHA-256:12192B5BA4B5827E5391D0C0345A635B2E11453E6ED1A94A189ED6261B74AD9A
                                                                                                                                                                                                                          SHA-512:84ED77C7737FC21B6E8D064A5F209513BFF842970BB1BE19AB4E68BD9AD02449E0BD307756488769FBA28D99872691BD3590A9D30ACD5F4A9EFE5AA7D1AB3461
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://td.doubleclick.net/td/rul/858128210?random=1730700453732&cv=11&fst=1730700453732&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4au0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730700255692837%26_winver%3D19045%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=977639762.1730700453&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion
                                                                                                                                                                                                                          Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":31104000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s977639762.1730700453","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s977639762.1730700453\u0026ig_key=1sNHM5Nzc2Mzk3NjIuMTczMDcwMDQ1Mw!2saQMApw!3sAAptDV4syVas","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1sqmtOXg!2saQMApw!3sAAptDV4syVas"],"userBiddingSignals":[["7900466892","596093288","475816165","7904705661","7896384790","8552333481","7904283812"],null,1730700455561456],"ads":[{"renderUrl":"https://tds

                                                                                                                                                                                                                          Chrome Cache Entry: 333

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (4968), with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4968
                                                                                                                                                                                                                          Entropy (8bit):5.860854642646837
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:5E8B8B7813A9A510B39631AF862E9C90
                                                                                                                                                                                                                          SHA1:945E8AAD38C8B6F6808B4237C222C3BF34435865
                                                                                                                                                                                                                          SHA-256:0F8E43DD219829D9CCA0D5ED1526080AA00029B45C8EF6BC98F3701073932474
                                                                                                                                                                                                                          SHA-512:2C54E6A41F5EE009BE5C6FE1D761E5717E455E41EF137C996FA613EFDE7E285B27D2F320AF490FBE3F36A75F8DC3C0CBFBA064E1F48B808489ED02863B968D21
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                                                          Chrome Cache Entry: 334

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):438953
                                                                                                                                                                                                                          Entropy (8bit):5.626435549614743
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:B7515729F143B6C51ED52C89A38100F7
                                                                                                                                                                                                                          SHA1:A18CDDF73E43E543F1CBFDA37BD9251417FA5FAB
                                                                                                                                                                                                                          SHA-256:9B02F3EA8228CD62755B70C55AABF444DACDDE08DB1C17DEE06AE9753B750E87
                                                                                                                                                                                                                          SHA-512:1FB3C2102729156414837670EC06AE0D1F291F72E3DCD7FE95D75617B035760CC513E2C4BB9B16C2984C6E76B1B9FCF5EB30DE5EDA56C13A64066A2B7972476B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                                                          Chrome Cache Entry: 335

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (723)
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):7076
                                                                                                                                                                                                                          Entropy (8bit):5.52488676121649
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:88A2E0A522036C0B87E03552E56629AA
                                                                                                                                                                                                                          SHA1:EC9D1157518E753A84DBDE1333A29B34CF776D63
                                                                                                                                                                                                                          SHA-256:788AFB96F2DA68E8729EC35F3D5E381FAD3482D37C54C2195C7311440EE4C27E
                                                                                                                                                                                                                          SHA-512:44B953878BD650FE2BCC8B6904620955C3E396B7DC8F41F85D021A8E0404DA41DB15C5499A03F7D4FE9129BB340AA3F6782942CF5327502FD4569BEBBB17073F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store
                                                                                                                                                                                                                          Preview:'use strict';var k=function(a){function b(c){return a.next(c)}function e(c){return a.throw(c)}return new Promise(function(c,d){function f(h){h.done?c(h.value):Promise.resolve(h.value).then(b,e).then(f,d)}f(a.next())})};/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var m=this||self;var u,v;a:{for(var x=["CLOSURE_FLAGS"],B=m,C=0;C<x.length;C++)if(B=B[x[C]],B==null){v=null;break a}v=B}var G=v&&v[610401301];u=G!=null?G:!1;var H;const I=m.navigator;H=I?I.userAgentData||null:null;function J(a){return u?H?H.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function K(a){var b;a:{const e=m.navigator;if(e){const c=e.userAgent;if(c){b=c;break a}}b=""}return b.indexOf(a)!=-1};function L(){return u?!!H&&H.brands.length>0:!1}function O(){return L()?J("Chromium"):(K("Chrome")||K("CriOS"))&&!(L()?0:K("Edge"))||K("Silk")};!K("Android")||O();O();!K("Safari")||O()||(L()?0:K("Coast"))||(L()?0:K("Opera"))||(L()?0:K("Edge"))||(L()?J("Microsoft Edge"):K("Edg/"))||L()&

                                                                                                                                                                                                                          Chrome Cache Entry: 336

                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                          Category:downloaded
                                                                                                                                                                                                                          Size (bytes):2118
                                                                                                                                                                                                                          Entropy (8bit):4.907323279161229
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:
                                                                                                                                                                                                                          MD5:1039640CF0666A1621D55C9E9FA81439
                                                                                                                                                                                                                          SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                                                                                                                                                                                                                          SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                                                                                                                                                                                                                          SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          URL:https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg
                                                                                                                                                                                                                          Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

                                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                          Entropy (8bit):7.612745880240488
                                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                          File name:Setup.exe
                                                                                                                                                                                                                          File size:190'056 bytes
                                                                                                                                                                                                                          MD5:f25415e055d48e6d0ab0c4b6c3165571
                                                                                                                                                                                                                          SHA1:daaebabd9d60f9b33971510e04cf94d53054869a
                                                                                                                                                                                                                          SHA256:79e9cfa54607c341197d5221ee016d6b1676988f5b50ce10ce04c2695eafcb3c
                                                                                                                                                                                                                          SHA512:3571f02bae1a9e28444f6c4758bfcc2e81e7d0a66e828172555de16e397c9b5c1f2b6313fc32cf3e906fd1754921f68c40f009e6ec482c8d66bb22075a1d2154
                                                                                                                                                                                                                          SSDEEP:3072:UbG7N2kDTHUpouL4Ynd86Pzy5n+/mGCK8izuG2okB2h4l591BBgkXmUF:UbE/HUzRe6ry5nmQiiGz4z9TJXrF
                                                                                                                                                                                                                          TLSH:BC04F15056E0C862D8A28B71B5797F7B8AB5DC2192B45F8313107B187E7DE819F0E3A3
                                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........

                                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                                          Icon Hash:45d44c7192498005

                                                                                                                                                                                                                          Static PE Info

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Entrypoint:0x40352d
                                                                                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                                                                                          Digitally signed:true
                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                                                                          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                          Time Stamp:0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
                                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                                          OS Version Major:4
                                                                                                                                                                                                                          OS Version Minor:0
                                                                                                                                                                                                                          File Version Major:4
                                                                                                                                                                                                                          File Version Minor:0
                                                                                                                                                                                                                          Subsystem Version Major:4
                                                                                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                                                                                          Import Hash:56a78d55f3f7af51443e58e0ce2fb5f6

                                                                                                                                                                                                                          Authenticode Signature

                                                                                                                                                                                                                          Signature Valid:true
                                                                                                                                                                                                                          Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                                                                                          Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                          Error Number:0
                                                                                                                                                                                                                          Not Before, Not After
                                                                                                                                                                                                                          • 08/05/2024 01:00:00 13/02/2025 23:59:59
                                                                                                                                                                                                                          Subject Chain
                                                                                                                                                                                                                          • CN=FAST CORPORATION LTD, O=FAST CORPORATION LTD, L=Ra'anana, C=IL, SERIALNUMBER=515636181, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IL
                                                                                                                                                                                                                          Version:3
                                                                                                                                                                                                                          Thumbprint MD5:04786BD703B906E22AECB2AD38CE4D94
                                                                                                                                                                                                                          Thumbprint SHA-1:07BE42727905BE32C822A638502C1B8FAAE6540A
                                                                                                                                                                                                                          Thumbprint SHA-256:FDB017BB88E5D453E22A73810690C72534F58EFB109EA0D4494EC393F2307DBC
                                                                                                                                                                                                                          Serial:0E5C655E1CBE9A8879372F58A5BC0302

                                                                                                                                                                                                                          Entrypoint Preview

                                                                                                                                                                                                                          Instruction
                                                                                                                                                                                                                          push ebp
                                                                                                                                                                                                                          mov ebp, esp
                                                                                                                                                                                                                          sub esp, 000003F4h
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          push esi
                                                                                                                                                                                                                          push edi
                                                                                                                                                                                                                          push 00000020h
                                                                                                                                                                                                                          pop edi
                                                                                                                                                                                                                          xor ebx, ebx
                                                                                                                                                                                                                          push 00008001h
                                                                                                                                                                                                                          mov dword ptr [ebp-14h], ebx
                                                                                                                                                                                                                          mov dword ptr [ebp-04h], 0040A2E0h
                                                                                                                                                                                                                          mov dword ptr [ebp-10h], ebx
                                                                                                                                                                                                                          call dword ptr [004080CCh]
                                                                                                                                                                                                                          mov esi, dword ptr [004080D0h]
                                                                                                                                                                                                                          lea eax, dword ptr [ebp-00000140h]
                                                                                                                                                                                                                          push eax
                                                                                                                                                                                                                          mov dword ptr [ebp-0000012Ch], ebx
                                                                                                                                                                                                                          mov dword ptr [ebp-2Ch], ebx
                                                                                                                                                                                                                          mov dword ptr [ebp-28h], ebx
                                                                                                                                                                                                                          mov dword ptr [ebp-00000140h], 0000011Ch
                                                                                                                                                                                                                          call esi
                                                                                                                                                                                                                          test eax, eax
                                                                                                                                                                                                                          jne 00007F4FB86D4F9Ah
                                                                                                                                                                                                                          lea eax, dword ptr [ebp-00000140h]
                                                                                                                                                                                                                          mov dword ptr [ebp-00000140h], 00000114h
                                                                                                                                                                                                                          push eax
                                                                                                                                                                                                                          call esi
                                                                                                                                                                                                                          mov ax, word ptr [ebp-0000012Ch]
                                                                                                                                                                                                                          mov ecx, dword ptr [ebp-00000112h]
                                                                                                                                                                                                                          sub ax, 00000053h
                                                                                                                                                                                                                          add ecx, FFFFFFD0h
                                                                                                                                                                                                                          neg ax
                                                                                                                                                                                                                          sbb eax, eax
                                                                                                                                                                                                                          mov byte ptr [ebp-26h], 00000004h
                                                                                                                                                                                                                          not eax
                                                                                                                                                                                                                          and eax, ecx
                                                                                                                                                                                                                          mov word ptr [ebp-2Ch], ax
                                                                                                                                                                                                                          cmp dword ptr [ebp-0000013Ch], 0Ah
                                                                                                                                                                                                                          jnc 00007F4FB86D4F6Ah
                                                                                                                                                                                                                          and word ptr [ebp-00000132h], 0000h
                                                                                                                                                                                                                          mov eax, dword ptr [ebp-00000134h]
                                                                                                                                                                                                                          movzx ecx, byte ptr [ebp-00000138h]
                                                                                                                                                                                                                          mov dword ptr [00434FB8h], eax
                                                                                                                                                                                                                          xor eax, eax
                                                                                                                                                                                                                          mov ah, byte ptr [ebp-0000013Ch]
                                                                                                                                                                                                                          movzx eax, ax
                                                                                                                                                                                                                          or eax, ecx
                                                                                                                                                                                                                          xor ecx, ecx
                                                                                                                                                                                                                          mov ch, byte ptr [ebp-2Ch]
                                                                                                                                                                                                                          movzx ecx, cx
                                                                                                                                                                                                                          shl eax, 10h
                                                                                                                                                                                                                          or eax, ecx

                                                                                                                                                                                                                          Rich Headers

                                                                                                                                                                                                                          Programming Language:
                                                                                                                                                                                                                          • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                          Data Directories

                                                                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x6c0000x4f40.rsrc
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x2bd000x2968.data
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                          Sections

                                                                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                          .text0x10000x68970x6a00ce9df19df15aa7bfbc0a8d0af0b841d0False0.6661261792452831data6.458398214928006IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .rdata0x80000x14a60x1600a118375c929d970903c1204233b7583dFalse0.4392755681818182data5.024109281264143IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .data0xa0000x2b0180x60082a10c59a8679bb952fc8316070b8a6cFalse0.521484375data4.15458210408643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                          .ndata0x360000x360000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                          .rsrc0x6c0000x4f400x50006147c56de0951034d77b52b0075b790fFalse0.1015625data2.760740823683962IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                          Resources

                                                                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                          RT_ICON0x6c2080x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/mEnglishUnited States0.036372224846480866
                                                                                                                                                                                                                          RT_DIALOG0x704300x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                                                                          RT_DIALOG0x706380xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                                                          RT_DIALOG0x707300xa0dataEnglishUnited States0.60625
                                                                                                                                                                                                                          RT_DIALOG0x707d00xeedataEnglishUnited States0.6302521008403361
                                                                                                                                                                                                                          RT_GROUP_ICON0x708c00x14dataEnglishUnited States1.1
                                                                                                                                                                                                                          RT_VERSION0x708d80x240dataEnglishUnited States0.4895833333333333
                                                                                                                                                                                                                          RT_MANIFEST0x70b180x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                                                                          Imports

                                                                                                                                                                                                                          DLLImport
                                                                                                                                                                                                                          ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
                                                                                                                                                                                                                          SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
                                                                                                                                                                                                                          ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
                                                                                                                                                                                                                          COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                                                                                                                                                                                                                          USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
                                                                                                                                                                                                                          GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                                                                                                                                                                                                                          KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

                                                                                                                                                                                                                          Possible Origin

                                                                                                                                                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                          EnglishUnited States

                                                                                                                                                                                                                          Network Behavior

                                                                                                                                                                                                                          ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                          Statistics

                                                                                                                                                                                                                          CPU Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          Memory Usage

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                                          Behavior

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          System Behavior

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                                          Start time:01:07:19
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\Setup.exe"
                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                          File size:190'056 bytes
                                                                                                                                                                                                                          MD5 hash:F25415E055D48E6D0AB0C4B6C3165571
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:1
                                                                                                                                                                                                                          Start time:01:07:27
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241104010727.305&_fcid=1730700255692837
                                                                                                                                                                                                                          Imagebase:0x7ff76e190000
                                                                                                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                                                                                                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:3
                                                                                                                                                                                                                          Start time:01:07:28
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                          Imagebase:0x7ff76e190000
                                                                                                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                                                                                                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:4
                                                                                                                                                                                                                          Start time:01:07:32
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5236 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                          Imagebase:0x7ff76e190000
                                                                                                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                                                                                                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:5
                                                                                                                                                                                                                          Start time:01:07:32
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=2016,i,11180620412387061188,5776203285063681324,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                          Imagebase:0x7ff76e190000
                                                                                                                                                                                                                          File size:3'242'272 bytes
                                                                                                                                                                                                                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:9
                                                                                                                                                                                                                          Start time:01:07:48
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force
                                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                                          File size:93'386'616 bytes
                                                                                                                                                                                                                          MD5 hash:84EE733F8014D22DAD2DFEF725489980
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Antivirus matches:
                                                                                                                                                                                                                          • Detection: 42%, ReversingLabs
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:10
                                                                                                                                                                                                                          Start time:01:08:24
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\PCAppStore\PcAppStore.exe" /init default
                                                                                                                                                                                                                          Imagebase:0x7ff7bc080000
                                                                                                                                                                                                                          File size:3'116'888 bytes
                                                                                                                                                                                                                          MD5 hash:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Antivirus matches:
                                                                                                                                                                                                                          • Detection: 5%, ReversingLabs
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:11
                                                                                                                                                                                                                          Start time:01:08:24
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241104010824.6836367156 /ver=fa.1092c
                                                                                                                                                                                                                          Imagebase:0x7ff6e97f0000
                                                                                                                                                                                                                          File size:276'312 bytes
                                                                                                                                                                                                                          MD5 hash:11F3801CB9FF046D6075F681971C4EB8
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Antivirus matches:
                                                                                                                                                                                                                          • Detection: 5%, ReversingLabs
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:12
                                                                                                                                                                                                                          Start time:01:08:25
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                                          Imagebase:0x7ff72b770000
                                                                                                                                                                                                                          File size:5'141'208 bytes
                                                                                                                                                                                                                          MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:14
                                                                                                                                                                                                                          Start time:01:08:31
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:16
                                                                                                                                                                                                                          Start time:01:08:31
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:17
                                                                                                                                                                                                                          Start time:01:08:31
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:18
                                                                                                                                                                                                                          Start time:01:08:32
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:19
                                                                                                                                                                                                                          Start time:01:08:32
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:20
                                                                                                                                                                                                                          Start time:01:08:33
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:21
                                                                                                                                                                                                                          Start time:01:08:33
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:22
                                                                                                                                                                                                                          Start time:01:08:33
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:23
                                                                                                                                                                                                                          Start time:01:08:33
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                                                                          Imagebase:0x7ff7bc080000
                                                                                                                                                                                                                          File size:3'116'888 bytes
                                                                                                                                                                                                                          MD5 hash:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:24
                                                                                                                                                                                                                          Start time:01:08:34
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:25
                                                                                                                                                                                                                          Start time:01:08:34
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:26
                                                                                                                                                                                                                          Start time:01:08:35
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:27
                                                                                                                                                                                                                          Start time:01:08:35
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:28
                                                                                                                                                                                                                          Start time:01:08:35
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:29
                                                                                                                                                                                                                          Start time:01:08:36
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:30
                                                                                                                                                                                                                          Start time:01:08:36
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:31
                                                                                                                                                                                                                          Start time:01:08:36
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:32
                                                                                                                                                                                                                          Start time:01:08:36
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:33
                                                                                                                                                                                                                          Start time:01:08:36
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:34
                                                                                                                                                                                                                          Start time:01:08:37
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:35
                                                                                                                                                                                                                          Start time:01:08:37
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:36
                                                                                                                                                                                                                          Start time:01:08:37
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:37
                                                                                                                                                                                                                          Start time:01:08:37
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:38
                                                                                                                                                                                                                          Start time:01:08:37
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:39
                                                                                                                                                                                                                          Start time:01:08:37
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:40
                                                                                                                                                                                                                          Start time:01:08:38
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:41
                                                                                                                                                                                                                          Start time:01:08:38
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:42
                                                                                                                                                                                                                          Start time:01:08:38
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:43
                                                                                                                                                                                                                          Start time:01:08:38
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          General

                                                                                                                                                                                                                          Target ID:44
                                                                                                                                                                                                                          Start time:01:08:39
                                                                                                                                                                                                                          Start date:04/11/2024
                                                                                                                                                                                                                          Path:C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe
                                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\MixnAZLVGJZSaFyGyvosJWQgTwTQHlEuTMKsFShWrHupkJtgIkdoQgwgW\CdHffnRZmAeqywugPqpABCcYuGUADn.exe"
                                                                                                                                                                                                                          Imagebase:0x470000
                                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                                          Disassembly

                                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:28.9%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:16.6%
                                                                                                                                                                                                                            Total number of Nodes:1349
                                                                                                                                                                                                                            Total number of Limit Nodes:40
                                                                                                                                                                                                                            execution_graph 2924 4015c1 2943 402da6 2924->2943 2928 401631 2930 401663 2928->2930 2931 401636 2928->2931 2933 401423 24 API calls 2930->2933 2970 401423 2931->2970 2940 40165b 2933->2940 2938 40164a SetCurrentDirectoryW 2938->2940 2939 401617 GetFileAttributesW 2941 4015d1 2939->2941 2941->2928 2941->2939 2955 405e39 2941->2955 2959 405b08 2941->2959 2962 405a6e CreateDirectoryW 2941->2962 2967 405aeb CreateDirectoryW 2941->2967 2944 402db2 2943->2944 2974 40657a 2944->2974 2947 4015c8 2949 405eb7 CharNextW CharNextW 2947->2949 2950 405ed4 2949->2950 2954 405ee6 2949->2954 2951 405ee1 CharNextW 2950->2951 2950->2954 2952 405f0a 2951->2952 2952->2941 2953 405e39 CharNextW 2953->2954 2954->2952 2954->2953 2956 405e3f 2955->2956 2957 405e55 2956->2957 2958 405e46 CharNextW 2956->2958 2957->2941 2958->2956 3012 40690a GetModuleHandleA 2959->3012 2963 405abb 2962->2963 2964 405abf GetLastError 2962->2964 2963->2941 2964->2963 2965 405ace SetFileSecurityW 2964->2965 2965->2963 2966 405ae4 GetLastError 2965->2966 2966->2963 2968 405afb 2967->2968 2969 405aff GetLastError 2967->2969 2968->2941 2969->2968 3021 40559f 2970->3021 2973 40653d lstrcpynW 2973->2938 2978 406587 2974->2978 2975 4067aa 2976 402dd3 2975->2976 3007 40653d lstrcpynW 2975->3007 2976->2947 2991 4067c4 2976->2991 2978->2975 2979 406778 lstrlenW 2978->2979 2982 40657a 10 API calls 2978->2982 2983 40668f GetSystemDirectoryW 2978->2983 2985 4066a2 GetWindowsDirectoryW 2978->2985 2986 406719 lstrcatW 2978->2986 2987 40657a 10 API calls 2978->2987 2988 4067c4 5 API calls 2978->2988 2989 4066d1 SHGetSpecialFolderLocation 2978->2989 3000 40640b 2978->3000 3005 406484 wsprintfW 2978->3005 3006 40653d lstrcpynW 2978->3006 2979->2978 2982->2979 2983->2978 2985->2978 2986->2978 2987->2978 2988->2978 2989->2978 2990 4066e9 SHGetPathFromIDListW CoTaskMemFree 2989->2990 2990->2978 2997 4067d1 2991->2997 2992 406847 2993 40684c CharPrevW 2992->2993 2995 40686d 2992->2995 2993->2992 2994 40683a CharNextW 2994->2992 2994->2997 2995->2947 2996 405e39 CharNextW 2996->2997 2997->2992 2997->2994 2997->2996 2998 406826 CharNextW 2997->2998 2999 406835 CharNextW 2997->2999 2998->2997 2999->2994 3008 4063aa 3000->3008 3003 40646f 3003->2978 3004 40643f RegQueryValueExW RegCloseKey 3004->3003 3005->2978 3006->2978 3007->2976 3009 4063b9 3008->3009 3010 4063c2 RegOpenKeyExW 3009->3010 3011 4063bd 3009->3011 3010->3011 3011->3003 3011->3004 3013 406930 GetProcAddress 3012->3013 3014 406926 3012->3014 3016 405b0f 3013->3016 3018 40689a GetSystemDirectoryW 3014->3018 3016->2941 3017 40692c 3017->3013 3017->3016 3019 4068bc wsprintfW LoadLibraryExW 3018->3019 3019->3017 3022 4055ba 3021->3022 3023 401431 3021->3023 3024 4055d6 lstrlenW 3022->3024 3025 40657a 17 API calls 3022->3025 3023->2973 3026 4055e4 lstrlenW 3024->3026 3027 4055ff 3024->3027 3025->3024 3026->3023 3028 4055f6 lstrcatW 3026->3028 3029 405612 3027->3029 3030 405605 SetWindowTextW 3027->3030 3028->3027 3029->3023 3031 405618 SendMessageW SendMessageW SendMessageW 3029->3031 3030->3029 3031->3023 3032 401941 3033 401943 3032->3033 3034 402da6 17 API calls 3033->3034 3035 401948 3034->3035 3038 405c49 3035->3038 3074 405f14 3038->3074 3041 405c71 DeleteFileW 3072 401951 3041->3072 3042 405c88 3043 405da8 3042->3043 3088 40653d lstrcpynW 3042->3088 3043->3072 3106 406873 FindFirstFileW 3043->3106 3045 405cae 3046 405cc1 3045->3046 3047 405cb4 lstrcatW 3045->3047 3089 405e58 lstrlenW 3046->3089 3049 405cc7 3047->3049 3051 405cd7 lstrcatW 3049->3051 3053 405ce2 lstrlenW FindFirstFileW 3049->3053 3051->3053 3053->3043 3065 405d04 3053->3065 3056 405d8b FindNextFileW 3060 405da1 FindClose 3056->3060 3056->3065 3057 405c01 5 API calls 3059 405de3 3057->3059 3061 405de7 3059->3061 3062 405dfd 3059->3062 3060->3043 3066 40559f 24 API calls 3061->3066 3061->3072 3064 40559f 24 API calls 3062->3064 3064->3072 3065->3056 3067 405c49 60 API calls 3065->3067 3069 40559f 24 API calls 3065->3069 3071 40559f 24 API calls 3065->3071 3093 40653d lstrcpynW 3065->3093 3094 405c01 3065->3094 3102 4062fd MoveFileExW 3065->3102 3068 405df4 3066->3068 3067->3065 3070 4062fd 36 API calls 3068->3070 3069->3056 3070->3072 3071->3065 3112 40653d lstrcpynW 3074->3112 3076 405f25 3077 405eb7 4 API calls 3076->3077 3078 405f2b 3077->3078 3079 405c69 3078->3079 3080 4067c4 5 API calls 3078->3080 3079->3041 3079->3042 3086 405f3b 3080->3086 3081 405f6c lstrlenW 3082 405f77 3081->3082 3081->3086 3084 405e0c 3 API calls 3082->3084 3083 406873 2 API calls 3083->3086 3085 405f7c GetFileAttributesW 3084->3085 3085->3079 3086->3079 3086->3081 3086->3083 3087 405e58 2 API calls 3086->3087 3087->3081 3088->3045 3090 405e66 3089->3090 3091 405e78 3090->3091 3092 405e6c CharPrevW 3090->3092 3091->3049 3092->3090 3092->3091 3093->3065 3113 406008 GetFileAttributesW 3094->3113 3097 405c2e 3097->3065 3098 405c24 DeleteFileW 3100 405c2a 3098->3100 3099 405c1c RemoveDirectoryW 3099->3100 3100->3097 3101 405c3a SetFileAttributesW 3100->3101 3101->3097 3103 406311 3102->3103 3105 40631e 3102->3105 3116 406183 3103->3116 3105->3065 3107 405dcd 3106->3107 3108 406889 FindClose 3106->3108 3107->3072 3109 405e0c lstrlenW CharPrevW 3107->3109 3108->3107 3110 405dd7 3109->3110 3111 405e28 lstrcatW 3109->3111 3110->3057 3111->3110 3112->3076 3114 405c0d 3113->3114 3115 40601a SetFileAttributesW 3113->3115 3114->3097 3114->3098 3114->3099 3115->3114 3117 4061b3 3116->3117 3118 4061d9 GetShortPathNameW 3116->3118 3143 40602d GetFileAttributesW CreateFileW 3117->3143 3120 4062f8 3118->3120 3121 4061ee 3118->3121 3120->3105 3121->3120 3123 4061f6 wsprintfA 3121->3123 3122 4061bd CloseHandle GetShortPathNameW 3122->3120 3124 4061d1 3122->3124 3125 40657a 17 API calls 3123->3125 3124->3118 3124->3120 3126 40621e 3125->3126 3144 40602d GetFileAttributesW CreateFileW 3126->3144 3128 40622b 3128->3120 3129 40623a GetFileSize GlobalAlloc 3128->3129 3130 4062f1 CloseHandle 3129->3130 3131 40625c 3129->3131 3130->3120 3145 4060b0 ReadFile 3131->3145 3136 40627b lstrcpyA 3139 40629d 3136->3139 3137 40628f 3138 405f92 4 API calls 3137->3138 3138->3139 3140 4062d4 SetFilePointer 3139->3140 3152 4060df WriteFile 3140->3152 3143->3122 3144->3128 3146 4060ce 3145->3146 3146->3130 3147 405f92 lstrlenA 3146->3147 3148 405fd3 lstrlenA 3147->3148 3149 405fdb 3148->3149 3150 405fac lstrcmpiA 3148->3150 3149->3136 3149->3137 3150->3149 3151 405fca CharNextA 3150->3151 3151->3148 3153 4060fd GlobalFree 3152->3153 3153->3130 3168 401c43 3169 402d84 17 API calls 3168->3169 3170 401c4a 3169->3170 3171 402d84 17 API calls 3170->3171 3172 401c57 3171->3172 3173 401c6c 3172->3173 3174 402da6 17 API calls 3172->3174 3175 401c7c 3173->3175 3176 402da6 17 API calls 3173->3176 3174->3173 3177 401cd3 3175->3177 3178 401c87 3175->3178 3176->3175 3180 402da6 17 API calls 3177->3180 3179 402d84 17 API calls 3178->3179 3182 401c8c 3179->3182 3181 401cd8 3180->3181 3183 402da6 17 API calls 3181->3183 3184 402d84 17 API calls 3182->3184 3185 401ce1 FindWindowExW 3183->3185 3186 401c98 3184->3186 3189 401d03 3185->3189 3187 401cc3 SendMessageW 3186->3187 3188 401ca5 SendMessageTimeoutW 3186->3188 3187->3189 3188->3189 3834 404943 3835 404953 3834->3835 3836 404979 3834->3836 3837 404499 18 API calls 3835->3837 3838 404500 8 API calls 3836->3838 3839 404960 SetDlgItemTextW 3837->3839 3840 404985 3838->3840 3839->3836 3841 4028c4 3842 4028ca 3841->3842 3843 4028d2 FindClose 3842->3843 3844 402c2a 3842->3844 3843->3844 3848 4016cc 3849 402da6 17 API calls 3848->3849 3850 4016d2 GetFullPathNameW 3849->3850 3851 4016ec 3850->3851 3857 40170e 3850->3857 3854 406873 2 API calls 3851->3854 3851->3857 3852 401723 GetShortPathNameW 3853 402c2a 3852->3853 3855 4016fe 3854->3855 3855->3857 3858 40653d lstrcpynW 3855->3858 3857->3852 3857->3853 3858->3857 3859 401e4e GetDC 3860 402d84 17 API calls 3859->3860 3861 401e60 GetDeviceCaps MulDiv ReleaseDC 3860->3861 3862 402d84 17 API calls 3861->3862 3863 401e91 3862->3863 3864 40657a 17 API calls 3863->3864 3865 401ece CreateFontIndirectW 3864->3865 3866 402638 3865->3866 3867 4045cf lstrcpynW lstrlenW 3868 402950 3869 402da6 17 API calls 3868->3869 3871 40295c 3869->3871 3870 402972 3873 406008 2 API calls 3870->3873 3871->3870 3872 402da6 17 API calls 3871->3872 3872->3870 3874 402978 3873->3874 3896 40602d GetFileAttributesW CreateFileW 3874->3896 3876 402985 3877 402a3b 3876->3877 3878 4029a0 GlobalAlloc 3876->3878 3879 402a23 3876->3879 3880 402a42 DeleteFileW 3877->3880 3881 402a55 3877->3881 3878->3879 3882 4029b9 3878->3882 3883 4032b4 31 API calls 3879->3883 3880->3881 3897 4034e5 SetFilePointer 3882->3897 3885 402a30 CloseHandle 3883->3885 3885->3877 3886 4029bf 3887 4034cf ReadFile 3886->3887 3888 4029c8 GlobalAlloc 3887->3888 3889 4029d8 3888->3889 3890 402a0c 3888->3890 3891 4032b4 31 API calls 3889->3891 3892 4060df WriteFile 3890->3892 3895 4029e5 3891->3895 3893 402a18 GlobalFree 3892->3893 3893->3879 3894 402a03 GlobalFree 3894->3890 3895->3894 3896->3876 3897->3886 3898 401956 3899 402da6 17 API calls 3898->3899 3900 40195d lstrlenW 3899->3900 3901 402638 3900->3901 3902 4014d7 3903 402d84 17 API calls 3902->3903 3904 4014dd Sleep 3903->3904 3906 402c2a 3904->3906 3617 4020d8 3618 4020ea 3617->3618 3628 40219c 3617->3628 3619 402da6 17 API calls 3618->3619 3621 4020f1 3619->3621 3620 401423 24 API calls 3626 4022f6 3620->3626 3622 402da6 17 API calls 3621->3622 3623 4020fa 3622->3623 3624 402110 LoadLibraryExW 3623->3624 3625 402102 GetModuleHandleW 3623->3625 3627 402121 3624->3627 3624->3628 3625->3624 3625->3627 3637 406979 3627->3637 3628->3620 3631 402132 3634 401423 24 API calls 3631->3634 3635 402142 3631->3635 3632 40216b 3633 40559f 24 API calls 3632->3633 3633->3635 3634->3635 3635->3626 3636 40218e FreeLibrary 3635->3636 3636->3626 3642 40655f WideCharToMultiByte 3637->3642 3639 406996 3640 40699d GetProcAddress 3639->3640 3641 40212c 3639->3641 3640->3641 3641->3631 3641->3632 3642->3639 3907 404658 3908 404670 3907->3908 3914 40478a 3907->3914 3915 404499 18 API calls 3908->3915 3909 4047f4 3910 4048be 3909->3910 3911 4047fe GetDlgItem 3909->3911 3916 404500 8 API calls 3910->3916 3912 404818 3911->3912 3913 40487f 3911->3913 3912->3913 3920 40483e SendMessageW LoadCursorW SetCursor 3912->3920 3913->3910 3921 404891 3913->3921 3914->3909 3914->3910 3917 4047c5 GetDlgItem SendMessageW 3914->3917 3918 4046d7 3915->3918 3919 4048b9 3916->3919 3940 4044bb KiUserCallbackDispatcher 3917->3940 3923 404499 18 API calls 3918->3923 3944 404907 3920->3944 3926 4048a7 3921->3926 3927 404897 SendMessageW 3921->3927 3924 4046e4 CheckDlgButton 3923->3924 3938 4044bb KiUserCallbackDispatcher 3924->3938 3926->3919 3931 4048ad SendMessageW 3926->3931 3927->3926 3928 4047ef 3941 4048e3 3928->3941 3931->3919 3933 404702 GetDlgItem 3939 4044ce SendMessageW 3933->3939 3935 404718 SendMessageW 3936 404735 GetSysColor 3935->3936 3937 40473e SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 3935->3937 3936->3937 3937->3919 3938->3933 3939->3935 3940->3928 3942 4048f1 3941->3942 3943 4048f6 SendMessageW 3941->3943 3942->3943 3943->3909 3947 405b63 ShellExecuteExW 3944->3947 3946 40486d LoadCursorW SetCursor 3946->3913 3947->3946 3948 402b59 3949 402b60 3948->3949 3950 402bab 3948->3950 3953 402d84 17 API calls 3949->3953 3956 402ba9 3949->3956 3951 40690a 5 API calls 3950->3951 3952 402bb2 3951->3952 3954 402da6 17 API calls 3952->3954 3955 402b6e 3953->3955 3957 402bbb 3954->3957 3958 402d84 17 API calls 3955->3958 3957->3956 3959 402bbf IIDFromString 3957->3959 3961 402b7a 3958->3961 3959->3956 3960 402bce 3959->3960 3960->3956 3966 40653d lstrcpynW 3960->3966 3965 406484 wsprintfW 3961->3965 3964 402beb CoTaskMemFree 3964->3956 3965->3956 3966->3964 3760 40175c 3761 402da6 17 API calls 3760->3761 3762 401763 3761->3762 3763 40605c 2 API calls 3762->3763 3764 40176a 3763->3764 3765 40605c 2 API calls 3764->3765 3765->3764 3967 401d5d 3968 402d84 17 API calls 3967->3968 3969 401d6e SetWindowLongW 3968->3969 3970 402c2a 3969->3970 3766 4056de 3767 405888 3766->3767 3768 4056ff GetDlgItem GetDlgItem GetDlgItem 3766->3768 3770 405891 GetDlgItem CreateThread CloseHandle 3767->3770 3771 4058b9 3767->3771 3811 4044ce SendMessageW 3768->3811 3770->3771 3814 405672 5 API calls 3770->3814 3773 4058e4 3771->3773 3775 4058d0 ShowWindow ShowWindow 3771->3775 3776 405909 3771->3776 3772 40576f 3780 405776 GetClientRect GetSystemMetrics SendMessageW SendMessageW 3772->3780 3774 405944 3773->3774 3777 4058f8 3773->3777 3778 40591e ShowWindow 3773->3778 3774->3776 3787 405952 SendMessageW 3774->3787 3813 4044ce SendMessageW 3775->3813 3779 404500 8 API calls 3776->3779 3782 404472 SendMessageW 3777->3782 3783 405930 3778->3783 3784 40593e 3778->3784 3792 405917 3779->3792 3785 4057e4 3780->3785 3786 4057c8 SendMessageW SendMessageW 3780->3786 3782->3776 3788 40559f 24 API calls 3783->3788 3789 404472 SendMessageW 3784->3789 3790 4057f7 3785->3790 3791 4057e9 SendMessageW 3785->3791 3786->3785 3787->3792 3793 40596b CreatePopupMenu 3787->3793 3788->3784 3789->3774 3795 404499 18 API calls 3790->3795 3791->3790 3794 40657a 17 API calls 3793->3794 3796 40597b AppendMenuW 3794->3796 3797 405807 3795->3797 3798 405998 GetWindowRect 3796->3798 3799 4059ab TrackPopupMenu 3796->3799 3800 405810 ShowWindow 3797->3800 3801 405844 GetDlgItem SendMessageW 3797->3801 3798->3799 3799->3792 3802 4059c6 3799->3802 3803 405833 3800->3803 3804 405826 ShowWindow 3800->3804 3801->3792 3805 40586b SendMessageW SendMessageW 3801->3805 3806 4059e2 SendMessageW 3802->3806 3812 4044ce SendMessageW 3803->3812 3804->3803 3805->3792 3806->3806 3807 4059ff OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3806->3807 3809 405a24 SendMessageW 3807->3809 3809->3809 3810 405a4d GlobalUnlock SetClipboardData CloseClipboard 3809->3810 3810->3792 3811->3772 3812->3801 3813->3773 3815 401ede 3816 402d84 17 API calls 3815->3816 3817 401ee4 3816->3817 3818 402d84 17 API calls 3817->3818 3819 401ef0 3818->3819 3820 401f07 EnableWindow 3819->3820 3821 401efc ShowWindow 3819->3821 3822 402c2a 3820->3822 3821->3822 3971 4028de 3972 4028e6 3971->3972 3973 4028ea FindNextFileW 3972->3973 3976 4028fc 3972->3976 3974 402943 3973->3974 3973->3976 3977 40653d lstrcpynW 3974->3977 3977->3976 3978 404ce0 3979 404cf0 3978->3979 3980 404d0c 3978->3980 3989 405b81 GetDlgItemTextW 3979->3989 3981 404d12 SHGetPathFromIDListW 3980->3981 3982 404d3f 3980->3982 3984 404d29 SendMessageW 3981->3984 3985 404d22 3981->3985 3984->3982 3987 40140b 2 API calls 3985->3987 3986 404cfd SendMessageW 3986->3980 3987->3984 3989->3986 3190 405b63 ShellExecuteExW 3990 401563 3991 402ba4 3990->3991 3994 406484 wsprintfW 3991->3994 3993 402ba9 3994->3993 3995 401968 3996 402d84 17 API calls 3995->3996 3997 40196f 3996->3997 3998 402d84 17 API calls 3997->3998 3999 40197c 3998->3999 4000 402da6 17 API calls 3999->4000 4001 401993 lstrlenW 4000->4001 4002 4019a4 4001->4002 4006 4019e5 4002->4006 4007 40653d lstrcpynW 4002->4007 4004 4019d5 4005 4019da lstrlenW 4004->4005 4004->4006 4005->4006 4007->4004 4008 40166a 4009 402da6 17 API calls 4008->4009 4010 401670 4009->4010 4011 406873 2 API calls 4010->4011 4012 401676 4011->4012 4013 402aeb 4014 402d84 17 API calls 4013->4014 4015 402af1 4014->4015 4016 40292e 4015->4016 4017 40657a 17 API calls 4015->4017 4017->4016 3286 4026ec 3287 402d84 17 API calls 3286->3287 3288 4026fb 3287->3288 3289 402745 ReadFile 3288->3289 3290 4060b0 ReadFile 3288->3290 3291 4027de 3288->3291 3293 402785 MultiByteToWideChar 3288->3293 3294 40283a 3288->3294 3296 4027ab SetFilePointer MultiByteToWideChar 3288->3296 3297 40284b 3288->3297 3299 402838 3288->3299 3289->3288 3289->3299 3290->3288 3291->3288 3291->3299 3300 40610e SetFilePointer 3291->3300 3293->3288 3309 406484 wsprintfW 3294->3309 3296->3288 3298 40286c SetFilePointer 3297->3298 3297->3299 3298->3299 3301 40612a 3300->3301 3304 406142 3300->3304 3302 4060b0 ReadFile 3301->3302 3303 406136 3302->3303 3303->3304 3305 406173 SetFilePointer 3303->3305 3306 40614b SetFilePointer 3303->3306 3304->3291 3305->3304 3306->3305 3307 406156 3306->3307 3308 4060df WriteFile 3307->3308 3308->3304 3309->3299 3556 40176f 3557 402da6 17 API calls 3556->3557 3558 401776 3557->3558 3559 401796 3558->3559 3560 40179e 3558->3560 3595 40653d lstrcpynW 3559->3595 3596 40653d lstrcpynW 3560->3596 3563 40179c 3567 4067c4 5 API calls 3563->3567 3564 4017a9 3565 405e0c 3 API calls 3564->3565 3566 4017af lstrcatW 3565->3566 3566->3563 3584 4017bb 3567->3584 3568 406873 2 API calls 3568->3584 3569 406008 2 API calls 3569->3584 3571 4017cd CompareFileTime 3571->3584 3572 40188d 3574 40559f 24 API calls 3572->3574 3573 401864 3575 40559f 24 API calls 3573->3575 3579 401879 3573->3579 3577 401897 3574->3577 3575->3579 3576 40653d lstrcpynW 3576->3584 3578 4032b4 31 API calls 3577->3578 3580 4018aa 3578->3580 3581 4018be SetFileTime 3580->3581 3582 4018d0 CloseHandle 3580->3582 3581->3582 3582->3579 3585 4018e1 3582->3585 3583 40657a 17 API calls 3583->3584 3584->3568 3584->3569 3584->3571 3584->3572 3584->3573 3584->3576 3584->3583 3590 405b9d MessageBoxIndirectW 3584->3590 3594 40602d GetFileAttributesW CreateFileW 3584->3594 3586 4018e6 3585->3586 3587 4018f9 3585->3587 3588 40657a 17 API calls 3586->3588 3589 40657a 17 API calls 3587->3589 3591 4018ee lstrcatW 3588->3591 3592 401901 3589->3592 3590->3584 3591->3592 3593 405b9d MessageBoxIndirectW 3592->3593 3593->3579 3594->3584 3595->3563 3596->3564 4018 401a72 4019 402d84 17 API calls 4018->4019 4020 401a7b 4019->4020 4021 402d84 17 API calls 4020->4021 4022 401a20 4021->4022 4023 401573 4024 401583 ShowWindow 4023->4024 4025 40158c 4023->4025 4024->4025 4026 402c2a 4025->4026 4027 40159a ShowWindow 4025->4027 4027->4026 4028 4023f4 4029 402da6 17 API calls 4028->4029 4030 402403 4029->4030 4031 402da6 17 API calls 4030->4031 4032 40240c 4031->4032 4033 402da6 17 API calls 4032->4033 4034 402416 GetPrivateProfileStringW 4033->4034 4035 4014f5 SetForegroundWindow 4036 402c2a 4035->4036 4037 401ff6 4038 402da6 17 API calls 4037->4038 4039 401ffd 4038->4039 4040 406873 2 API calls 4039->4040 4041 402003 4040->4041 4043 402014 4041->4043 4044 406484 wsprintfW 4041->4044 4044->4043 4045 401b77 4046 402da6 17 API calls 4045->4046 4047 401b7e 4046->4047 4048 402d84 17 API calls 4047->4048 4049 401b87 wsprintfW 4048->4049 4050 402c2a 4049->4050 4051 40167b 4052 402da6 17 API calls 4051->4052 4053 401682 4052->4053 4054 402da6 17 API calls 4053->4054 4055 40168b 4054->4055 4056 402da6 17 API calls 4055->4056 4057 401694 MoveFileW 4056->4057 4058 4016a7 4057->4058 4064 4016a0 4057->4064 4060 406873 2 API calls 4058->4060 4062 4022f6 4058->4062 4059 401423 24 API calls 4059->4062 4061 4016b6 4060->4061 4061->4062 4063 4062fd 36 API calls 4061->4063 4063->4064 4064->4059 4065 4019ff 4066 402da6 17 API calls 4065->4066 4067 401a06 4066->4067 4068 402da6 17 API calls 4067->4068 4069 401a0f 4068->4069 4070 401a16 lstrcmpiW 4069->4070 4071 401a28 lstrcmpW 4069->4071 4072 401a1c 4070->4072 4071->4072 4073 4022ff 4074 402da6 17 API calls 4073->4074 4075 402305 4074->4075 4076 402da6 17 API calls 4075->4076 4077 40230e 4076->4077 4078 402da6 17 API calls 4077->4078 4079 402317 4078->4079 4080 406873 2 API calls 4079->4080 4081 402320 4080->4081 4082 402331 lstrlenW lstrlenW 4081->4082 4083 402324 4081->4083 4085 40559f 24 API calls 4082->4085 4084 40559f 24 API calls 4083->4084 4087 40232c 4083->4087 4084->4087 4086 40236f SHFileOperationW 4085->4086 4086->4083 4086->4087 4088 401000 4089 401037 BeginPaint GetClientRect 4088->4089 4090 40100c DefWindowProcW 4088->4090 4092 4010f3 4089->4092 4095 401179 4090->4095 4093 401073 CreateBrushIndirect FillRect DeleteObject 4092->4093 4094 4010fc 4092->4094 4093->4092 4096 401102 CreateFontIndirectW 4094->4096 4097 401167 EndPaint 4094->4097 4096->4097 4098 401112 6 API calls 4096->4098 4097->4095 4098->4097 3154 401d81 3155 401d94 GetDlgItem 3154->3155 3156 401d87 3154->3156 3157 401d8e 3155->3157 3165 402d84 3156->3165 3159 401dd5 GetClientRect LoadImageW SendMessageW 3157->3159 3160 402da6 17 API calls 3157->3160 3162 401e33 3159->3162 3164 401e3f 3159->3164 3160->3159 3163 401e38 DeleteObject 3162->3163 3162->3164 3163->3164 3166 40657a 17 API calls 3165->3166 3167 402d99 3166->3167 3167->3157 4099 401503 4100 40150b 4099->4100 4102 40151e 4099->4102 4101 402d84 17 API calls 4100->4101 4101->4102 4103 402383 4104 40238a 4103->4104 4107 40239d 4103->4107 4105 40657a 17 API calls 4104->4105 4106 402397 4105->4106 4108 405b9d MessageBoxIndirectW 4106->4108 4108->4107 3217 402c05 SendMessageW 3218 402c2a 3217->3218 3219 402c1f InvalidateRect 3217->3219 3219->3218 4109 404f06 GetDlgItem GetDlgItem 4110 404f58 7 API calls 4109->4110 4116 40517d 4109->4116 4111 404ff2 SendMessageW 4110->4111 4112 404fff DeleteObject 4110->4112 4111->4112 4113 405008 4112->4113 4114 40503f 4113->4114 4117 40657a 17 API calls 4113->4117 4118 404499 18 API calls 4114->4118 4115 40525f 4119 40530b 4115->4119 4129 4052b8 SendMessageW 4115->4129 4149 405170 4115->4149 4116->4115 4120 4051ec 4116->4120 4163 404e54 SendMessageW 4116->4163 4123 405021 SendMessageW SendMessageW 4117->4123 4124 405053 4118->4124 4121 405315 SendMessageW 4119->4121 4122 40531d 4119->4122 4120->4115 4125 405251 SendMessageW 4120->4125 4121->4122 4131 405336 4122->4131 4132 40532f ImageList_Destroy 4122->4132 4147 405346 4122->4147 4123->4113 4128 404499 18 API calls 4124->4128 4125->4115 4126 404500 8 API calls 4130 40550c 4126->4130 4142 405064 4128->4142 4134 4052cd SendMessageW 4129->4134 4129->4149 4135 40533f GlobalFree 4131->4135 4131->4147 4132->4131 4133 4054c0 4138 4054d2 ShowWindow GetDlgItem ShowWindow 4133->4138 4133->4149 4137 4052e0 4134->4137 4135->4147 4136 40513f GetWindowLongW SetWindowLongW 4139 405158 4136->4139 4148 4052f1 SendMessageW 4137->4148 4138->4149 4140 405175 4139->4140 4141 40515d ShowWindow 4139->4141 4162 4044ce SendMessageW 4140->4162 4161 4044ce SendMessageW 4141->4161 4142->4136 4143 40513a 4142->4143 4146 4050b7 SendMessageW 4142->4146 4150 4050f5 SendMessageW 4142->4150 4151 405109 SendMessageW 4142->4151 4143->4136 4143->4139 4146->4142 4147->4133 4154 405381 4147->4154 4168 404ed4 4147->4168 4148->4119 4149->4126 4150->4142 4151->4142 4153 40548b 4155 405496 InvalidateRect 4153->4155 4158 4054a2 4153->4158 4156 4053af SendMessageW 4154->4156 4157 4053c5 4154->4157 4155->4158 4156->4157 4157->4153 4159 405439 SendMessageW SendMessageW 4157->4159 4158->4133 4177 404e0f 4158->4177 4159->4157 4161->4149 4162->4116 4164 404eb3 SendMessageW 4163->4164 4165 404e77 GetMessagePos ScreenToClient SendMessageW 4163->4165 4167 404eab 4164->4167 4166 404eb0 4165->4166 4165->4167 4166->4164 4167->4120 4180 40653d lstrcpynW 4168->4180 4170 404ee7 4181 406484 wsprintfW 4170->4181 4172 404ef1 4173 40140b 2 API calls 4172->4173 4174 404efa 4173->4174 4182 40653d lstrcpynW 4174->4182 4176 404f01 4176->4154 4183 404d46 4177->4183 4179 404e24 4179->4133 4180->4170 4181->4172 4182->4176 4184 404d5f 4183->4184 4185 40657a 17 API calls 4184->4185 4186 404dc3 4185->4186 4187 40657a 17 API calls 4186->4187 4188 404dce 4187->4188 4189 40657a 17 API calls 4188->4189 4190 404de4 lstrlenW wsprintfW SetDlgItemTextW 4189->4190 4190->4179 4191 404609 lstrlenW 4192 404628 4191->4192 4193 40462a WideCharToMultiByte 4191->4193 4192->4193 3220 40248a 3221 402da6 17 API calls 3220->3221 3222 40249c 3221->3222 3223 402da6 17 API calls 3222->3223 3224 4024a6 3223->3224 3237 402e36 3224->3237 3227 40292e 3228 4024de 3230 4024ea 3228->3230 3232 402d84 17 API calls 3228->3232 3229 402da6 17 API calls 3231 4024d4 lstrlenW 3229->3231 3233 402509 RegSetValueExW 3230->3233 3241 4032b4 3230->3241 3231->3228 3232->3230 3235 40251f RegCloseKey 3233->3235 3235->3227 3238 402e51 3237->3238 3261 4063d8 3238->3261 3242 4032cd 3241->3242 3243 4032fb 3242->3243 3268 4034e5 SetFilePointer 3242->3268 3265 4034cf 3243->3265 3247 403468 3249 4034aa 3247->3249 3252 40346c 3247->3252 3248 403318 GetTickCount 3253 403452 3248->3253 3257 403367 3248->3257 3250 4034cf ReadFile 3249->3250 3250->3253 3251 4034cf ReadFile 3251->3257 3252->3253 3254 4034cf ReadFile 3252->3254 3255 4060df WriteFile 3252->3255 3253->3233 3254->3252 3255->3252 3256 4033bd GetTickCount 3256->3257 3257->3251 3257->3253 3257->3256 3258 4033e2 MulDiv wsprintfW 3257->3258 3260 4060df WriteFile 3257->3260 3259 40559f 24 API calls 3258->3259 3259->3257 3260->3257 3262 4063e7 3261->3262 3263 4063f2 RegCreateKeyExW 3262->3263 3264 4024b6 3262->3264 3263->3264 3264->3227 3264->3228 3264->3229 3266 4060b0 ReadFile 3265->3266 3267 403306 3266->3267 3267->3247 3267->3248 3267->3253 3268->3243 4194 40498a 4195 4049b6 4194->4195 4196 4049c7 4194->4196 4255 405b81 GetDlgItemTextW 4195->4255 4197 4049d3 GetDlgItem 4196->4197 4204 404a32 4196->4204 4200 4049e7 4197->4200 4199 4049c1 4202 4067c4 5 API calls 4199->4202 4203 4049fb SetWindowTextW 4200->4203 4207 405eb7 4 API calls 4200->4207 4201 404b16 4253 404cc5 4201->4253 4257 405b81 GetDlgItemTextW 4201->4257 4202->4196 4208 404499 18 API calls 4203->4208 4204->4201 4209 40657a 17 API calls 4204->4209 4204->4253 4206 404500 8 API calls 4211 404cd9 4206->4211 4212 4049f1 4207->4212 4213 404a17 4208->4213 4214 404aa6 SHBrowseForFolderW 4209->4214 4210 404b46 4215 405f14 18 API calls 4210->4215 4212->4203 4219 405e0c 3 API calls 4212->4219 4216 404499 18 API calls 4213->4216 4214->4201 4217 404abe CoTaskMemFree 4214->4217 4218 404b4c 4215->4218 4220 404a25 4216->4220 4221 405e0c 3 API calls 4217->4221 4258 40653d lstrcpynW 4218->4258 4219->4203 4256 4044ce SendMessageW 4220->4256 4223 404acb 4221->4223 4226 404b02 SetDlgItemTextW 4223->4226 4230 40657a 17 API calls 4223->4230 4225 404a2b 4228 40690a 5 API calls 4225->4228 4226->4201 4227 404b63 4229 40690a 5 API calls 4227->4229 4228->4204 4241 404b6a 4229->4241 4231 404aea lstrcmpiW 4230->4231 4231->4226 4233 404afb lstrcatW 4231->4233 4232 404bab 4259 40653d lstrcpynW 4232->4259 4233->4226 4235 404bb2 4236 405eb7 4 API calls 4235->4236 4237 404bb8 GetDiskFreeSpaceW 4236->4237 4239 404bdc MulDiv 4237->4239 4243 404c03 4237->4243 4239->4243 4240 405e58 2 API calls 4240->4241 4241->4232 4241->4240 4241->4243 4242 404c74 4245 404c97 4242->4245 4247 40140b 2 API calls 4242->4247 4243->4242 4244 404e0f 20 API calls 4243->4244 4246 404c61 4244->4246 4260 4044bb KiUserCallbackDispatcher 4245->4260 4248 404c76 SetDlgItemTextW 4246->4248 4249 404c66 4246->4249 4247->4245 4248->4242 4251 404d46 20 API calls 4249->4251 4251->4242 4252 404cb3 4252->4253 4254 4048e3 SendMessageW 4252->4254 4253->4206 4254->4253 4255->4199 4256->4225 4257->4210 4258->4227 4259->4235 4260->4252 4261 40290b 4262 402da6 17 API calls 4261->4262 4263 402912 FindFirstFileW 4262->4263 4264 40293a 4263->4264 4267 402925 4263->4267 4269 406484 wsprintfW 4264->4269 4266 402943 4270 40653d lstrcpynW 4266->4270 4269->4266 4270->4267 4271 40190c 4272 401943 4271->4272 4273 402da6 17 API calls 4272->4273 4274 401948 4273->4274 4275 405c49 67 API calls 4274->4275 4276 401951 4275->4276 4277 40190f 4278 402da6 17 API calls 4277->4278 4279 401916 4278->4279 4280 405b9d MessageBoxIndirectW 4279->4280 4281 40191f 4280->4281 3597 402891 3598 402898 3597->3598 3599 402ba9 3597->3599 3600 402d84 17 API calls 3598->3600 3601 40289f 3600->3601 3602 4028ae SetFilePointer 3601->3602 3602->3599 3603 4028be 3602->3603 3605 406484 wsprintfW 3603->3605 3605->3599 4282 401491 4283 40559f 24 API calls 4282->4283 4284 401498 4283->4284 3606 403b12 3607 403b2a 3606->3607 3608 403b1c CloseHandle 3606->3608 3613 403b57 3607->3613 3608->3607 3611 405c49 67 API calls 3612 403b3b 3611->3612 3615 403b65 3613->3615 3614 403b2f 3614->3611 3615->3614 3616 403b6a FreeLibrary GlobalFree 3615->3616 3616->3614 3616->3616 4285 401f12 4286 402da6 17 API calls 4285->4286 4287 401f18 4286->4287 4288 402da6 17 API calls 4287->4288 4289 401f21 4288->4289 4290 402da6 17 API calls 4289->4290 4291 401f2a 4290->4291 4292 402da6 17 API calls 4291->4292 4293 401f33 4292->4293 4294 401423 24 API calls 4293->4294 4295 401f3a 4294->4295 4302 405b63 ShellExecuteExW 4295->4302 4297 401f82 4298 40292e 4297->4298 4299 4069b5 5 API calls 4297->4299 4300 401f9f CloseHandle 4299->4300 4300->4298 4302->4297 4303 405513 4304 405523 4303->4304 4305 405537 4303->4305 4306 405580 4304->4306 4307 405529 4304->4307 4308 40553f IsWindowVisible 4305->4308 4314 405556 4305->4314 4309 405585 CallWindowProcW 4306->4309 4310 4044e5 SendMessageW 4307->4310 4308->4306 4311 40554c 4308->4311 4312 405533 4309->4312 4310->4312 4313 404e54 5 API calls 4311->4313 4313->4314 4314->4309 4315 404ed4 4 API calls 4314->4315 4315->4306 4316 402f93 4317 402fa5 SetTimer 4316->4317 4318 402fbe 4316->4318 4317->4318 4319 403013 4318->4319 4320 402fd8 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4318->4320 4320->4319 4321 401d17 4322 402d84 17 API calls 4321->4322 4323 401d1d IsWindow 4322->4323 4324 401a20 4323->4324 3643 403f9a 3644 403fb2 3643->3644 3645 404113 3643->3645 3644->3645 3646 403fbe 3644->3646 3647 404164 3645->3647 3648 404124 GetDlgItem GetDlgItem 3645->3648 3650 403fc9 SetWindowPos 3646->3650 3651 403fdc 3646->3651 3649 4041be 3647->3649 3660 401389 2 API calls 3647->3660 3652 404499 18 API calls 3648->3652 3653 4044e5 SendMessageW 3649->3653 3661 40410e 3649->3661 3650->3651 3654 403fe5 ShowWindow 3651->3654 3655 404027 3651->3655 3656 40414e SetClassLongW 3652->3656 3682 4041d0 3653->3682 3662 4040d1 3654->3662 3663 404005 GetWindowLongW 3654->3663 3657 404046 3655->3657 3658 40402f DestroyWindow 3655->3658 3659 40140b 2 API calls 3656->3659 3665 40404b SetWindowLongW 3657->3665 3666 40405c 3657->3666 3664 404422 3658->3664 3659->3647 3667 404196 3660->3667 3723 404500 3662->3723 3663->3662 3669 40401e ShowWindow 3663->3669 3664->3661 3676 404453 ShowWindow 3664->3676 3665->3661 3666->3662 3670 404068 GetDlgItem 3666->3670 3667->3649 3671 40419a SendMessageW 3667->3671 3669->3655 3674 404096 3670->3674 3675 404079 SendMessageW IsWindowEnabled 3670->3675 3671->3661 3672 40140b 2 API calls 3672->3682 3673 404424 DestroyWindow KiUserCallbackDispatcher 3673->3664 3678 4040a3 3674->3678 3680 4040ea SendMessageW 3674->3680 3681 4040b6 3674->3681 3688 40409b 3674->3688 3675->3661 3675->3674 3676->3661 3677 40657a 17 API calls 3677->3682 3678->3680 3678->3688 3680->3662 3683 4040d3 3681->3683 3684 4040be 3681->3684 3682->3661 3682->3672 3682->3673 3682->3677 3685 404499 18 API calls 3682->3685 3705 404364 DestroyWindow 3682->3705 3714 404499 3682->3714 3686 40140b 2 API calls 3683->3686 3687 40140b 2 API calls 3684->3687 3685->3682 3686->3688 3687->3688 3688->3662 3720 404472 3688->3720 3690 40424b GetDlgItem 3691 404260 3690->3691 3692 404268 ShowWindow KiUserCallbackDispatcher 3690->3692 3691->3692 3717 4044bb KiUserCallbackDispatcher 3692->3717 3694 404292 KiUserCallbackDispatcher 3699 4042a6 3694->3699 3695 4042ab GetSystemMenu EnableMenuItem SendMessageW 3696 4042db SendMessageW 3695->3696 3695->3699 3696->3699 3698 403f7b 18 API calls 3698->3699 3699->3695 3699->3698 3718 4044ce SendMessageW 3699->3718 3719 40653d lstrcpynW 3699->3719 3701 40430a lstrlenW 3702 40657a 17 API calls 3701->3702 3703 404320 SetWindowTextW 3702->3703 3704 401389 2 API calls 3703->3704 3704->3682 3705->3664 3706 40437e CreateDialogParamW 3705->3706 3706->3664 3707 4043b1 3706->3707 3708 404499 18 API calls 3707->3708 3709 4043bc GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3708->3709 3710 401389 2 API calls 3709->3710 3711 404402 3710->3711 3711->3661 3712 40440a ShowWindow 3711->3712 3713 4044e5 SendMessageW 3712->3713 3713->3664 3715 40657a 17 API calls 3714->3715 3716 4044a4 SetDlgItemTextW 3715->3716 3716->3690 3717->3694 3718->3699 3719->3701 3721 404479 3720->3721 3722 40447f SendMessageW 3720->3722 3721->3722 3722->3662 3724 4045c3 3723->3724 3725 404518 GetWindowLongW 3723->3725 3724->3661 3725->3724 3726 40452d 3725->3726 3726->3724 3727 40455a GetSysColor 3726->3727 3728 40455d 3726->3728 3727->3728 3729 404563 SetTextColor 3728->3729 3730 40456d SetBkMode 3728->3730 3729->3730 3731 404585 GetSysColor 3730->3731 3732 40458b 3730->3732 3731->3732 3733 404592 SetBkColor 3732->3733 3734 40459c 3732->3734 3733->3734 3734->3724 3735 4045b6 CreateBrushIndirect 3734->3735 3736 4045af DeleteObject 3734->3736 3735->3724 3736->3735 3737 401b9b 3738 401ba8 3737->3738 3739 401bec 3737->3739 3744 401c31 3738->3744 3745 401bbf 3738->3745 3740 401bf1 3739->3740 3741 401c16 GlobalAlloc 3739->3741 3746 40239d 3740->3746 3756 40653d lstrcpynW 3740->3756 3742 40657a 17 API calls 3741->3742 3742->3744 3743 40657a 17 API calls 3747 402397 3743->3747 3744->3743 3744->3746 3757 40653d lstrcpynW 3745->3757 3752 405b9d MessageBoxIndirectW 3747->3752 3750 401c03 GlobalFree 3750->3746 3751 401bce 3758 40653d lstrcpynW 3751->3758 3752->3746 3754 401bdd 3759 40653d lstrcpynW 3754->3759 3756->3750 3757->3751 3758->3754 3759->3746 4325 40261c 4326 402da6 17 API calls 4325->4326 4327 402623 4326->4327 4330 40602d GetFileAttributesW CreateFileW 4327->4330 4329 40262f 4330->4329 3823 40259e 3824 402de6 17 API calls 3823->3824 3825 4025a8 3824->3825 3826 402d84 17 API calls 3825->3826 3827 4025b1 3826->3827 3828 4025d9 RegEnumValueW 3827->3828 3829 4025cd RegEnumKeyW 3827->3829 3830 40292e 3827->3830 3831 4025f5 RegCloseKey 3828->3831 3832 4025ee 3828->3832 3829->3831 3831->3830 3832->3831 4331 40149e 4332 4014ac PostQuitMessage 4331->4332 4333 40239d 4331->4333 4332->4333 4334 4015a3 4335 402da6 17 API calls 4334->4335 4336 4015aa SetFileAttributesW 4335->4336 4337 4015bc 4336->4337 3191 401fa4 3192 402da6 17 API calls 3191->3192 3193 401faa 3192->3193 3194 40559f 24 API calls 3193->3194 3195 401fb4 3194->3195 3204 405b20 CreateProcessW 3195->3204 3198 40292e 3201 401fcf 3202 401fdd CloseHandle 3201->3202 3212 406484 wsprintfW 3201->3212 3202->3198 3205 405b53 CloseHandle 3204->3205 3206 401fba 3204->3206 3205->3206 3206->3198 3206->3202 3207 4069b5 WaitForSingleObject 3206->3207 3208 4069cf 3207->3208 3209 4069e1 GetExitCodeProcess 3208->3209 3213 406946 3208->3213 3209->3201 3212->3202 3214 406963 PeekMessageW 3213->3214 3215 406973 WaitForSingleObject 3214->3215 3216 406959 DispatchMessageW 3214->3216 3215->3208 3216->3214 3269 40252a 3280 402de6 3269->3280 3272 402da6 17 API calls 3273 40253d 3272->3273 3274 402548 RegQueryValueExW 3273->3274 3279 40292e 3273->3279 3275 40256e RegCloseKey 3274->3275 3276 402568 3274->3276 3275->3279 3276->3275 3285 406484 wsprintfW 3276->3285 3281 402da6 17 API calls 3280->3281 3282 402dfd 3281->3282 3283 4063aa RegOpenKeyExW 3282->3283 3284 402534 3283->3284 3284->3272 3285->3275 4338 40202a 4339 402da6 17 API calls 4338->4339 4340 402031 4339->4340 4341 40690a 5 API calls 4340->4341 4342 402040 4341->4342 4343 40205c GlobalAlloc 4342->4343 4346 4020cc 4342->4346 4344 402070 4343->4344 4343->4346 4345 40690a 5 API calls 4344->4345 4347 402077 4345->4347 4348 40690a 5 API calls 4347->4348 4349 402081 4348->4349 4349->4346 4353 406484 wsprintfW 4349->4353 4351 4020ba 4354 406484 wsprintfW 4351->4354 4353->4351 4354->4346 4355 4021aa 4356 402da6 17 API calls 4355->4356 4357 4021b1 4356->4357 4358 402da6 17 API calls 4357->4358 4359 4021bb 4358->4359 4360 402da6 17 API calls 4359->4360 4361 4021c5 4360->4361 4362 402da6 17 API calls 4361->4362 4363 4021cf 4362->4363 4364 402da6 17 API calls 4363->4364 4365 4021d9 4364->4365 4366 402218 CoCreateInstance 4365->4366 4367 402da6 17 API calls 4365->4367 4370 402237 4366->4370 4367->4366 4368 401423 24 API calls 4369 4022f6 4368->4369 4370->4368 4370->4369 4371 403baa 4372 403bb5 4371->4372 4373 403bb9 4372->4373 4374 403bbc GlobalAlloc 4372->4374 4374->4373 3310 40352d SetErrorMode GetVersionExW 3311 4035b7 3310->3311 3312 40357f GetVersionExW 3310->3312 3313 403610 3311->3313 3314 40690a 5 API calls 3311->3314 3312->3311 3315 40689a 3 API calls 3313->3315 3314->3313 3316 403626 lstrlenA 3315->3316 3316->3313 3317 403636 3316->3317 3318 40690a 5 API calls 3317->3318 3319 40363d 3318->3319 3320 40690a 5 API calls 3319->3320 3321 403644 3320->3321 3322 40690a 5 API calls 3321->3322 3326 403650 #17 OleInitialize SHGetFileInfoW 3322->3326 3325 40369d GetCommandLineW 3401 40653d lstrcpynW 3325->3401 3400 40653d lstrcpynW 3326->3400 3328 4036af 3329 405e39 CharNextW 3328->3329 3330 4036d5 CharNextW 3329->3330 3342 4036e6 3330->3342 3331 4037e4 3332 4037f8 GetTempPathW 3331->3332 3402 4034fc 3332->3402 3334 403810 3336 403814 GetWindowsDirectoryW lstrcatW 3334->3336 3337 40386a DeleteFileW 3334->3337 3335 405e39 CharNextW 3335->3342 3338 4034fc 12 API calls 3336->3338 3412 40307d GetTickCount GetModuleFileNameW 3337->3412 3340 403830 3338->3340 3340->3337 3343 403834 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3340->3343 3341 40387d 3345 403a59 ExitProcess CoUninitialize 3341->3345 3347 403932 3341->3347 3355 405e39 CharNextW 3341->3355 3342->3331 3342->3335 3344 4037e6 3342->3344 3346 4034fc 12 API calls 3343->3346 3496 40653d lstrcpynW 3344->3496 3349 403a69 3345->3349 3350 403a7e 3345->3350 3354 403862 3346->3354 3440 403bec 3347->3440 3501 405b9d 3349->3501 3352 403a86 GetCurrentProcess OpenProcessToken 3350->3352 3353 403afc ExitProcess 3350->3353 3358 403acc 3352->3358 3359 403a9d LookupPrivilegeValueW AdjustTokenPrivileges 3352->3359 3354->3337 3354->3345 3369 40389f 3355->3369 3362 40690a 5 API calls 3358->3362 3359->3358 3360 403941 3360->3345 3365 403ad3 3362->3365 3363 403908 3366 405f14 18 API calls 3363->3366 3364 403949 3368 405b08 5 API calls 3364->3368 3367 403ae8 ExitWindowsEx 3365->3367 3371 403af5 3365->3371 3370 403914 3366->3370 3367->3353 3367->3371 3372 40394e lstrcatW 3368->3372 3369->3363 3369->3364 3370->3345 3497 40653d lstrcpynW 3370->3497 3505 40140b 3371->3505 3373 40396a lstrcatW lstrcmpiW 3372->3373 3374 40395f lstrcatW 3372->3374 3373->3360 3376 40398a 3373->3376 3374->3373 3378 403996 3376->3378 3379 40398f 3376->3379 3382 405aeb 2 API calls 3378->3382 3381 405a6e 4 API calls 3379->3381 3380 403927 3498 40653d lstrcpynW 3380->3498 3384 403994 3381->3384 3385 40399b SetCurrentDirectoryW 3382->3385 3384->3385 3386 4039b8 3385->3386 3387 4039ad 3385->3387 3500 40653d lstrcpynW 3386->3500 3499 40653d lstrcpynW 3387->3499 3390 40657a 17 API calls 3391 4039fa DeleteFileW 3390->3391 3392 403a06 CopyFileW 3391->3392 3397 4039c5 3391->3397 3392->3397 3393 403a50 3395 4062fd 36 API calls 3393->3395 3394 4062fd 36 API calls 3394->3397 3395->3360 3396 40657a 17 API calls 3396->3397 3397->3390 3397->3393 3397->3394 3397->3396 3398 405b20 2 API calls 3397->3398 3399 403a3a CloseHandle 3397->3399 3398->3397 3399->3397 3400->3325 3401->3328 3403 4067c4 5 API calls 3402->3403 3405 403508 3403->3405 3404 403512 3404->3334 3405->3404 3406 405e0c 3 API calls 3405->3406 3407 40351a 3406->3407 3408 405aeb 2 API calls 3407->3408 3409 403520 3408->3409 3508 40605c 3409->3508 3512 40602d GetFileAttributesW CreateFileW 3412->3512 3414 4030bd 3432 4030cd 3414->3432 3513 40653d lstrcpynW 3414->3513 3416 4030e3 3417 405e58 2 API calls 3416->3417 3418 4030e9 3417->3418 3514 40653d lstrcpynW 3418->3514 3420 4030f4 GetFileSize 3421 4031ee 3420->3421 3439 40310b 3420->3439 3515 403019 3421->3515 3423 4031f7 3425 403227 GlobalAlloc 3423->3425 3423->3432 3527 4034e5 SetFilePointer 3423->3527 3424 4034cf ReadFile 3424->3439 3526 4034e5 SetFilePointer 3425->3526 3427 40325a 3429 403019 6 API calls 3427->3429 3429->3432 3430 403210 3433 4034cf ReadFile 3430->3433 3431 403242 3434 4032b4 31 API calls 3431->3434 3432->3341 3435 40321b 3433->3435 3437 40324e 3434->3437 3435->3425 3435->3432 3436 403019 6 API calls 3436->3439 3437->3432 3437->3437 3438 40328b SetFilePointer 3437->3438 3438->3432 3439->3421 3439->3424 3439->3427 3439->3432 3439->3436 3441 40690a 5 API calls 3440->3441 3442 403c00 3441->3442 3443 403c06 3442->3443 3444 403c18 3442->3444 3543 406484 wsprintfW 3443->3543 3445 40640b 3 API calls 3444->3445 3446 403c48 3445->3446 3448 403c67 lstrcatW 3446->3448 3450 40640b 3 API calls 3446->3450 3449 403c16 3448->3449 3528 403ec2 3449->3528 3450->3448 3453 405f14 18 API calls 3454 403c99 3453->3454 3455 403d2d 3454->3455 3457 40640b 3 API calls 3454->3457 3456 405f14 18 API calls 3455->3456 3458 403d33 3456->3458 3459 403ccb 3457->3459 3460 403d43 LoadImageW 3458->3460 3461 40657a 17 API calls 3458->3461 3459->3455 3464 403cec lstrlenW 3459->3464 3467 405e39 CharNextW 3459->3467 3462 403de9 3460->3462 3463 403d6a RegisterClassW 3460->3463 3461->3460 3466 40140b 2 API calls 3462->3466 3465 403da0 SystemParametersInfoW CreateWindowExW 3463->3465 3495 403df3 3463->3495 3468 403d20 3464->3468 3469 403cfa lstrcmpiW 3464->3469 3465->3462 3473 403def 3466->3473 3471 403ce9 3467->3471 3470 405e0c 3 API calls 3468->3470 3469->3468 3472 403d0a GetFileAttributesW 3469->3472 3475 403d26 3470->3475 3471->3464 3476 403d16 3472->3476 3474 403ec2 18 API calls 3473->3474 3473->3495 3477 403e00 3474->3477 3544 40653d lstrcpynW 3475->3544 3476->3468 3479 405e58 2 API calls 3476->3479 3480 403e0c ShowWindow 3477->3480 3481 403e8f 3477->3481 3479->3468 3483 40689a 3 API calls 3480->3483 3536 405672 OleInitialize 3481->3536 3485 403e24 3483->3485 3484 403e95 3486 403eb1 3484->3486 3487 403e99 3484->3487 3488 403e32 GetClassInfoW 3485->3488 3490 40689a 3 API calls 3485->3490 3489 40140b 2 API calls 3486->3489 3493 40140b 2 API calls 3487->3493 3487->3495 3491 403e46 GetClassInfoW RegisterClassW 3488->3491 3492 403e5c DialogBoxParamW 3488->3492 3489->3495 3490->3488 3491->3492 3494 40140b 2 API calls 3492->3494 3493->3495 3494->3495 3495->3360 3496->3332 3497->3380 3498->3347 3499->3386 3500->3397 3502 405bb2 3501->3502 3503 403a76 ExitProcess 3502->3503 3504 405bc6 MessageBoxIndirectW 3502->3504 3504->3503 3506 401389 2 API calls 3505->3506 3507 401420 3506->3507 3507->3353 3509 406069 GetTickCount GetTempFileNameW 3508->3509 3510 40352b 3509->3510 3511 40609f 3509->3511 3510->3334 3511->3509 3511->3510 3512->3414 3513->3416 3514->3420 3516 403022 3515->3516 3517 40303a 3515->3517 3518 403032 3516->3518 3519 40302b DestroyWindow 3516->3519 3520 403042 3517->3520 3521 40304a GetTickCount 3517->3521 3518->3423 3519->3518 3522 406946 2 API calls 3520->3522 3523 403058 CreateDialogParamW ShowWindow 3521->3523 3524 40307b 3521->3524 3525 403048 3522->3525 3523->3524 3524->3423 3525->3423 3526->3431 3527->3430 3529 403ed6 3528->3529 3545 406484 wsprintfW 3529->3545 3531 403f47 3546 403f7b 3531->3546 3533 403c77 3533->3453 3534 403f4c 3534->3533 3535 40657a 17 API calls 3534->3535 3535->3534 3549 4044e5 3536->3549 3538 405695 3542 4056bc 3538->3542 3552 401389 3538->3552 3539 4044e5 SendMessageW 3540 4056ce OleUninitialize 3539->3540 3540->3484 3542->3539 3543->3449 3544->3455 3545->3531 3547 40657a 17 API calls 3546->3547 3548 403f89 SetWindowTextW 3547->3548 3548->3534 3550 4044fd 3549->3550 3551 4044ee SendMessageW 3549->3551 3550->3538 3551->3550 3554 401390 3552->3554 3553 4013fe 3553->3538 3554->3553 3555 4013cb MulDiv SendMessageW 3554->3555 3555->3554 4375 401a30 4376 402da6 17 API calls 4375->4376 4377 401a39 ExpandEnvironmentStringsW 4376->4377 4378 401a4d 4377->4378 4380 401a60 4377->4380 4379 401a52 lstrcmpW 4378->4379 4378->4380 4379->4380 4386 4023b2 4387 4023c0 4386->4387 4388 4023ba 4386->4388 4390 4023ce 4387->4390 4391 402da6 17 API calls 4387->4391 4389 402da6 17 API calls 4388->4389 4389->4387 4392 402da6 17 API calls 4390->4392 4394 4023dc 4390->4394 4391->4390 4392->4394 4393 402da6 17 API calls 4395 4023e5 WritePrivateProfileStringW 4393->4395 4394->4393 4396 402434 4397 402467 4396->4397 4398 40243c 4396->4398 4399 402da6 17 API calls 4397->4399 4400 402de6 17 API calls 4398->4400 4401 40246e 4399->4401 4402 402443 4400->4402 4407 402e64 4401->4407 4404 402da6 17 API calls 4402->4404 4405 40247b 4402->4405 4406 402454 RegDeleteValueW RegCloseKey 4404->4406 4406->4405 4408 402e71 4407->4408 4409 402e78 4407->4409 4408->4405 4409->4408 4411 402ea9 4409->4411 4412 4063aa RegOpenKeyExW 4411->4412 4413 402ed7 4412->4413 4414 402ee7 RegEnumValueW 4413->4414 4415 402f0a 4413->4415 4422 402f81 4413->4422 4414->4415 4416 402f71 RegCloseKey 4414->4416 4415->4416 4417 402f46 RegEnumKeyW 4415->4417 4418 402f4f RegCloseKey 4415->4418 4421 402ea9 6 API calls 4415->4421 4416->4422 4417->4415 4417->4418 4419 40690a 5 API calls 4418->4419 4420 402f5f 4419->4420 4420->4422 4423 402f63 RegDeleteKeyW 4420->4423 4421->4415 4422->4408 4423->4422 4424 401735 4425 402da6 17 API calls 4424->4425 4426 40173c SearchPathW 4425->4426 4427 401757 4426->4427 4428 401d38 4429 402d84 17 API calls 4428->4429 4430 401d3f 4429->4430 4431 402d84 17 API calls 4430->4431 4432 401d4b GetDlgItem 4431->4432 4433 402638 4432->4433 4434 4014b8 4435 4014be 4434->4435 4436 401389 2 API calls 4435->4436 4437 4014c6 4436->4437 4438 40263e 4439 402652 4438->4439 4440 40266d 4438->4440 4441 402d84 17 API calls 4439->4441 4442 402672 4440->4442 4443 40269d 4440->4443 4450 402659 4441->4450 4444 402da6 17 API calls 4442->4444 4445 402da6 17 API calls 4443->4445 4447 402679 4444->4447 4446 4026a4 lstrlenW 4445->4446 4446->4450 4455 40655f WideCharToMultiByte 4447->4455 4449 40268d lstrlenA 4449->4450 4451 4026d1 4450->4451 4452 4026e7 4450->4452 4454 40610e 5 API calls 4450->4454 4451->4452 4453 4060df WriteFile 4451->4453 4453->4452 4454->4451 4455->4449

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 0040352D Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 450stringfilecomCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 0 40352d-40357d SetErrorMode GetVersionExW 1 4035b7-4035be 0->1 2 40357f-4035b3 GetVersionExW 0->2 3 4035c0 1->3 4 4035c8-403608 1->4 2->1 3->4 5 40360a-403612 call 40690a 4->5 6 40361b 4->6 5->6 11 403614 5->11 8 403620-403634 call 40689a lstrlenA 6->8 13 403636-403652 call 40690a * 3 8->13 11->6 20 403663-4036c5 #17 OleInitialize SHGetFileInfoW call 40653d GetCommandLineW call 40653d 13->20 21 403654-40365a 13->21 28 4036c7-4036c9 20->28 29 4036ce-4036e1 call 405e39 CharNextW 20->29 21->20 25 40365c 21->25 25->20 28->29 32 4037d8-4037de 29->32 33 4037e4 32->33 34 4036e6-4036ec 32->34 37 4037f8-403812 GetTempPathW call 4034fc 33->37 35 4036f5-4036fb 34->35 36 4036ee-4036f3 34->36 38 403702-403706 35->38 39 4036fd-403701 35->39 36->35 36->36 47 403814-403832 GetWindowsDirectoryW lstrcatW call 4034fc 37->47 48 40386a-403882 DeleteFileW call 40307d 37->48 41 4037c6-4037d4 call 405e39 38->41 42 40370c-403712 38->42 39->38 41->32 59 4037d6-4037d7 41->59 45 403714-40371b 42->45 46 40372c-403765 42->46 52 403722 45->52 53 40371d-403720 45->53 54 403781-4037bb 46->54 55 403767-40376c 46->55 47->48 62 403834-403864 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 4034fc 47->62 64 403888-40388e 48->64 65 403a59-403a67 ExitProcess CoUninitialize 48->65 52->46 53->46 53->52 57 4037c3-4037c5 54->57 58 4037bd-4037c1 54->58 55->54 61 40376e-403776 55->61 57->41 58->57 63 4037e6-4037f3 call 40653d 58->63 59->32 66 403778-40377b 61->66 67 40377d 61->67 62->48 62->65 63->37 69 403894-4038a7 call 405e39 64->69 70 403935-40393c call 403bec 64->70 72 403a69-403a78 call 405b9d ExitProcess 65->72 73 403a7e-403a84 65->73 66->54 66->67 67->54 88 4038f9-403906 69->88 89 4038a9-4038de 69->89 84 403941-403944 70->84 75 403a86-403a9b GetCurrentProcess OpenProcessToken 73->75 76 403afc-403b04 73->76 81 403acc-403ada call 40690a 75->81 82 403a9d-403ac6 LookupPrivilegeValueW AdjustTokenPrivileges 75->82 85 403b06 76->85 86 403b09-403b0c ExitProcess 76->86 95 403ae8-403af3 ExitWindowsEx 81->95 96 403adc-403ae6 81->96 82->81 84->65 85->86 90 403908-403916 call 405f14 88->90 91 403949-40395d call 405b08 lstrcatW 88->91 93 4038e0-4038e4 89->93 90->65 106 40391c-403932 call 40653d * 2 90->106 104 40396a-403984 lstrcatW lstrcmpiW 91->104 105 40395f-403965 lstrcatW 91->105 98 4038e6-4038eb 93->98 99 4038ed-4038f5 93->99 95->76 102 403af5-403af7 call 40140b 95->102 96->95 96->102 98->99 100 4038f7 98->100 99->93 99->100 100->88 102->76 109 403a57 104->109 110 40398a-40398d 104->110 105->104 106->70 109->65 112 403996 call 405aeb 110->112 113 40398f-403994 call 405a6e 110->113 119 40399b-4039ab SetCurrentDirectoryW 112->119 113->119 121 4039b8-4039e4 call 40653d 119->121 122 4039ad-4039b3 call 40653d 119->122 126 4039e9-403a04 call 40657a DeleteFileW 121->126 122->121 129 403a44-403a4e 126->129 130 403a06-403a16 CopyFileW 126->130 129->126 132 403a50-403a52 call 4062fd 129->132 130->129 131 403a18-403a38 call 4062fd call 40657a call 405b20 130->131 131->129 140 403a3a-403a41 CloseHandle 131->140 132->109 140->129
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00008001), ref: 00403550
                                                                                                                                                                                                                            • GetVersionExW.KERNEL32(?), ref: 00403579
                                                                                                                                                                                                                            • GetVersionExW.KERNEL32(0000011C), ref: 00403590
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
                                                                                                                                                                                                                            • #17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
                                                                                                                                                                                                                            • OleInitialize.OLE32(00000000), ref: 0040366A
                                                                                                                                                                                                                            • SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
                                                                                                                                                                                                                            • GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
                                                                                                                                                                                                                            • CharNextW.USER32(00000000,00440000,00000020,00440000,00000000), ref: 004036D6
                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(1033), ref: 0040386F
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403956
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403965
                                                                                                                                                                                                                              • Part of subcall function 00405AEB: CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403970
                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00441800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 0040397C
                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(0042AA28,0042AA28,?,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,?), ref: 004039FB
                                                                                                                                                                                                                            • CopyFileW.KERNEL32(C:\Users\user\Desktop\Setup.exe,0042AA28,00000001), ref: 00403A0E
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
                                                                                                                                                                                                                            • ExitProcess.KERNEL32(?), ref: 00403A59
                                                                                                                                                                                                                            • CoUninitialize.COMBASE(?), ref: 00403A5E
                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00403A78
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
                                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
                                                                                                                                                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
                                                                                                                                                                                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
                                                                                                                                                                                                                            • ExitWindowsEx.USER32(00000002,80040002), ref: 00403AEB
                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00403B0C
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
                                                                                                                                                                                                                            • String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp$C:\Users\user\Desktop\Setup.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                            • API String ID: 2292928366-1504291086
                                                                                                                                                                                                                            • Opcode ID: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
                                                                                                                                                                                                                            • Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D
                                                                                                                                                                                                                            Function 004056DE Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 141 4056de-4056f9 142 405888-40588f 141->142 143 4056ff-4057c6 GetDlgItem * 3 call 4044ce call 404e27 GetClientRect GetSystemMetrics SendMessageW * 2 141->143 145 405891-4058b3 GetDlgItem CreateThread CloseHandle 142->145 146 4058b9-4058c6 142->146 165 4057e4-4057e7 143->165 166 4057c8-4057e2 SendMessageW * 2 143->166 145->146 148 4058e4-4058ee 146->148 149 4058c8-4058ce 146->149 150 4058f0-4058f6 148->150 151 405944-405948 148->151 153 4058d0-4058df ShowWindow * 2 call 4044ce 149->153 154 405909-405912 call 404500 149->154 155 4058f8-405904 call 404472 150->155 156 40591e-40592e ShowWindow 150->156 151->154 159 40594a-405950 151->159 153->148 162 405917-40591b 154->162 155->154 163 405930-405939 call 40559f 156->163 164 40593e-40593f call 404472 156->164 159->154 167 405952-405965 SendMessageW 159->167 163->164 164->151 170 4057f7-40580e call 404499 165->170 171 4057e9-4057f5 SendMessageW 165->171 166->165 172 405a67-405a69 167->172 173 40596b-405996 CreatePopupMenu call 40657a AppendMenuW 167->173 180 405810-405824 ShowWindow 170->180 181 405844-405865 GetDlgItem SendMessageW 170->181 171->170 172->162 178 405998-4059a8 GetWindowRect 173->178 179 4059ab-4059c0 TrackPopupMenu 173->179 178->179 179->172 182 4059c6-4059dd 179->182 183 405833 180->183 184 405826-405831 ShowWindow 180->184 181->172 185 40586b-405883 SendMessageW * 2 181->185 186 4059e2-4059fd SendMessageW 182->186 187 405839-40583f call 4044ce 183->187 184->187 185->172 186->186 188 4059ff-405a22 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 186->188 187->181 190 405a24-405a4b SendMessageW 188->190 190->190 191 405a4d-405a61 GlobalUnlock SetClipboardData CloseClipboard 190->191 191->172
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000403), ref: 0040573C
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 0040574B
                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 00405788
                                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000002), ref: 0040578F
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B0
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C1
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D4
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E2
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 004057F5
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405817
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000008), ref: 0040582B
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 0040584C
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040585C
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405875
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405881
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F8), ref: 0040575A
                                                                                                                                                                                                                              • Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 0040589E
                                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_00005672,00000000), ref: 004058AC
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004058B3
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 004058D7
                                                                                                                                                                                                                            • ShowWindow.USER32(00030466,00000008), ref: 004058DC
                                                                                                                                                                                                                            • ShowWindow.USER32(00000008), ref: 00405926
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595A
                                                                                                                                                                                                                            • CreatePopupMenu.USER32 ref: 0040596B
                                                                                                                                                                                                                            • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040597F
                                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 0040599F
                                                                                                                                                                                                                            • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059B8
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F0
                                                                                                                                                                                                                            • OpenClipboard.USER32(00000000), ref: 00405A00
                                                                                                                                                                                                                            • EmptyClipboard.USER32 ref: 00405A06
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A12
                                                                                                                                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00405A1C
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A30
                                                                                                                                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00405A50
                                                                                                                                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00405A5B
                                                                                                                                                                                                                            • CloseClipboard.USER32 ref: 00405A61
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                            • String ID: <?y${
                                                                                                                                                                                                                            • API String ID: 590372296-1738821792
                                                                                                                                                                                                                            • Opcode ID: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
                                                                                                                                                                                                                            • Instruction ID: 6b97441d6f4cfe62a880681573964a63c423f2dd70b2063085686802d9cc5617
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C8B169B1900608FFDB119FA0DD85AAE7B79FB44355F00803AFA41BA1A0C7755E51DF58
                                                                                                                                                                                                                            Function 00405C49 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 498 405c49-405c6f call 405f14 501 405c71-405c83 DeleteFileW 498->501 502 405c88-405c8f 498->502 503 405e05-405e09 501->503 504 405c91-405c93 502->504 505 405ca2-405cb2 call 40653d 502->505 506 405db3-405db8 504->506 507 405c99-405c9c 504->507 513 405cc1-405cc2 call 405e58 505->513 514 405cb4-405cbf lstrcatW 505->514 506->503 509 405dba-405dbd 506->509 507->505 507->506 511 405dc7-405dcf call 406873 509->511 512 405dbf-405dc5 509->512 511->503 522 405dd1-405de5 call 405e0c call 405c01 511->522 512->503 516 405cc7-405ccb 513->516 514->516 518 405cd7-405cdd lstrcatW 516->518 519 405ccd-405cd5 516->519 521 405ce2-405cfe lstrlenW FindFirstFileW 518->521 519->518 519->521 523 405d04-405d0c 521->523 524 405da8-405dac 521->524 538 405de7-405dea 522->538 539 405dfd-405e00 call 40559f 522->539 526 405d2c-405d40 call 40653d 523->526 527 405d0e-405d16 523->527 524->506 529 405dae 524->529 540 405d42-405d4a 526->540 541 405d57-405d62 call 405c01 526->541 530 405d18-405d20 527->530 531 405d8b-405d9b FindNextFileW 527->531 529->506 530->526 534 405d22-405d2a 530->534 531->523 537 405da1-405da2 FindClose 531->537 534->526 534->531 537->524 538->512 544 405dec-405dfb call 40559f call 4062fd 538->544 539->503 540->531 545 405d4c-405d55 call 405c49 540->545 549 405d83-405d86 call 40559f 541->549 550 405d64-405d67 541->550 544->503 545->531 549->531 553 405d69-405d79 call 40559f call 4062fd 550->553 554 405d7b-405d81 550->554 553->531 554->531
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk2875.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsk2875.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CBA
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsk2875.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CDD
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsk2875.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk2875.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsk2875.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
                                                                                                                                                                                                                            • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 00405DA2
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                            • String ID: .$.$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsk2875.tmp\*.*$\*.*
                                                                                                                                                                                                                            • API String ID: 2035342205-1596708780
                                                                                                                                                                                                                            • Opcode ID: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
                                                                                                                                                                                                                            • Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE
                                                                                                                                                                                                                            Function 00406873 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(74DF3420,004302B8,C:\,00405F5D,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 0040688A
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                            • String ID: C:\
                                                                                                                                                                                                                            • API String ID: 2295610775-3404278061
                                                                                                                                                                                                                            • Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                                                                                                                            • Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD
                                                                                                                                                                                                                            Function 00403F9A Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 192 403f9a-403fac 193 403fb2-403fb8 192->193 194 404113-404122 192->194 193->194 195 403fbe-403fc7 193->195 196 404171-404186 194->196 197 404124-40416c GetDlgItem * 2 call 404499 SetClassLongW call 40140b 194->197 200 403fc9-403fd6 SetWindowPos 195->200 201 403fdc-403fe3 195->201 198 4041c6-4041cb call 4044e5 196->198 199 404188-40418b 196->199 197->196 214 4041d0-4041eb 198->214 203 40418d-404198 call 401389 199->203 204 4041be-4041c0 199->204 200->201 206 403fe5-403fff ShowWindow 201->206 207 404027-40402d 201->207 203->204 228 40419a-4041b9 SendMessageW 203->228 204->198 213 404466 204->213 215 404100-40410e call 404500 206->215 216 404005-404018 GetWindowLongW 206->216 209 404046-404049 207->209 210 40402f-404041 DestroyWindow 207->210 220 40404b-404057 SetWindowLongW 209->220 221 40405c-404062 209->221 217 404443-404449 210->217 219 404468-40446f 213->219 224 4041f4-4041fa 214->224 225 4041ed-4041ef call 40140b 214->225 215->219 216->215 226 40401e-404021 ShowWindow 216->226 217->213 231 40444b-404451 217->231 220->219 221->215 227 404068-404077 GetDlgItem 221->227 232 404200-40420b 224->232 233 404424-40443d DestroyWindow KiUserCallbackDispatcher 224->233 225->224 226->207 235 404096-404099 227->235 236 404079-404090 SendMessageW IsWindowEnabled 227->236 228->219 231->213 237 404453-40445c ShowWindow 231->237 232->233 234 404211-40425e call 40657a call 404499 * 3 GetDlgItem 232->234 233->217 264 404260-404265 234->264 265 404268-4042a4 ShowWindow KiUserCallbackDispatcher call 4044bb KiUserCallbackDispatcher 234->265 239 40409b-40409c 235->239 240 40409e-4040a1 235->240 236->213 236->235 237->213 242 4040cc-4040d1 call 404472 239->242 243 4040a3-4040a9 240->243 244 4040af-4040b4 240->244 242->215 247 4040ea-4040fa SendMessageW 243->247 248 4040ab-4040ad 243->248 244->247 249 4040b6-4040bc 244->249 247->215 248->242 252 4040d3-4040dc call 40140b 249->252 253 4040be-4040c4 call 40140b 249->253 252->215 262 4040de-4040e8 252->262 260 4040ca 253->260 260->242 262->260 264->265 268 4042a6-4042a7 265->268 269 4042a9 265->269 270 4042ab-4042d9 GetSystemMenu EnableMenuItem SendMessageW 268->270 269->270 271 4042db-4042ec SendMessageW 270->271 272 4042ee 270->272 273 4042f4-404333 call 4044ce call 403f7b call 40653d lstrlenW call 40657a SetWindowTextW call 401389 271->273 272->273 273->214 284 404339-40433b 273->284 284->214 285 404341-404345 284->285 286 404364-404378 DestroyWindow 285->286 287 404347-40434d 285->287 286->217 289 40437e-4043ab CreateDialogParamW 286->289 287->213 288 404353-404359 287->288 288->214 290 40435f 288->290 289->217 291 4043b1-404408 call 404499 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 289->291 290->213 291->213 296 40440a-40441d ShowWindow call 4044e5 291->296 298 404422 296->298 298->217
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
                                                                                                                                                                                                                            • ShowWindow.USER32(?), ref: 00403FF6
                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00404008
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000004), ref: 00404021
                                                                                                                                                                                                                            • DestroyWindow.USER32 ref: 00404035
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,00000000,00000000), ref: 0040404E
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 0040406D
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
                                                                                                                                                                                                                            • IsWindowEnabled.USER32(00000000), ref: 00404088
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000001), ref: 00404133
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000002), ref: 0040413D
                                                                                                                                                                                                                            • SetClassLongW.USER32(?,000000F2,?), ref: 00404157
                                                                                                                                                                                                                            • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000003), ref: 0040424E
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?), ref: 0040426F
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404281
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040429C
                                                                                                                                                                                                                            • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
                                                                                                                                                                                                                            • EnableMenuItem.USER32(00000000), ref: 004042B9
                                                                                                                                                                                                                            • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,0042D268), ref: 00404322
                                                                                                                                                                                                                            • ShowWindow.USER32(?,0000000A), ref: 00404456
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
                                                                                                                                                                                                                            • String ID: <?y
                                                                                                                                                                                                                            • API String ID: 3964124867-2738300482
                                                                                                                                                                                                                            • Opcode ID: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
                                                                                                                                                                                                                            • Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D
                                                                                                                                                                                                                            Function 00403BEC Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 299 403bec-403c04 call 40690a 302 403c06-403c16 call 406484 299->302 303 403c18-403c4f call 40640b 299->303 312 403c72-403c9b call 403ec2 call 405f14 302->312 308 403c51-403c62 call 40640b 303->308 309 403c67-403c6d lstrcatW 303->309 308->309 309->312 317 403ca1-403ca6 312->317 318 403d2d-403d35 call 405f14 312->318 317->318 319 403cac-403cd4 call 40640b 317->319 324 403d43-403d68 LoadImageW 318->324 325 403d37-403d3e call 40657a 318->325 319->318 326 403cd6-403cda 319->326 328 403de9-403df1 call 40140b 324->328 329 403d6a-403d9a RegisterClassW 324->329 325->324 330 403cec-403cf8 lstrlenW 326->330 331 403cdc-403ce9 call 405e39 326->331 343 403df3-403df6 328->343 344 403dfb-403e06 call 403ec2 328->344 332 403da0-403de4 SystemParametersInfoW CreateWindowExW 329->332 333 403eb8 329->333 337 403d20-403d28 call 405e0c call 40653d 330->337 338 403cfa-403d08 lstrcmpiW 330->338 331->330 332->328 336 403eba-403ec1 333->336 337->318 338->337 342 403d0a-403d14 GetFileAttributesW 338->342 347 403d16-403d18 342->347 348 403d1a-403d1b call 405e58 342->348 343->336 352 403e0c-403e26 ShowWindow call 40689a 344->352 353 403e8f-403e90 call 405672 344->353 347->337 347->348 348->337 360 403e32-403e44 GetClassInfoW 352->360 361 403e28-403e2d call 40689a 352->361 356 403e95-403e97 353->356 358 403eb1-403eb3 call 40140b 356->358 359 403e99-403e9f 356->359 358->333 359->343 362 403ea5-403eac call 40140b 359->362 365 403e46-403e56 GetClassInfoW RegisterClassW 360->365 366 403e5c-403e7f DialogBoxParamW call 40140b 360->366 361->360 362->343 365->366 370 403e84-403e8d call 403b3c 366->370 370->336
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                                                                                                                              • Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403C6D
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420), ref: 00403CED
                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(Remove folder: ,?,00000000,?), ref: 00403D0B
                                                                                                                                                                                                                            • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00440800), ref: 00403D54
                                                                                                                                                                                                                              • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                                                            • RegisterClassW.USER32(00433EA0), ref: 00403D91
                                                                                                                                                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DA9
                                                                                                                                                                                                                            • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DDE
                                                                                                                                                                                                                            • ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403E40
                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403E4D
                                                                                                                                                                                                                            • RegisterClassW.USER32(00433EA0), ref: 00403E56
                                                                                                                                                                                                                            • DialogBoxParamW.USER32(?,00000000,00403F9A,00000000), ref: 00403E75
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                            • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                                                                            • API String ID: 1975747703-1389134667
                                                                                                                                                                                                                            • Opcode ID: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
                                                                                                                                                                                                                            • Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D
                                                                                                                                                                                                                            Function 0040307D Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 373 40307d-4030cb GetTickCount GetModuleFileNameW call 40602d 376 4030d7-403105 call 40653d call 405e58 call 40653d GetFileSize 373->376 377 4030cd-4030d2 373->377 385 4031f0-4031fe call 403019 376->385 386 40310b 376->386 378 4032ad-4032b1 377->378 392 403200-403203 385->392 393 403253-403258 385->393 388 403110-403127 386->388 390 403129 388->390 391 40312b-403134 call 4034cf 388->391 390->391 399 40325a-403262 call 403019 391->399 400 40313a-403141 391->400 395 403205-40321d call 4034e5 call 4034cf 392->395 396 403227-403251 GlobalAlloc call 4034e5 call 4032b4 392->396 393->378 395->393 419 40321f-403225 395->419 396->393 424 403264-403275 396->424 399->393 404 403143-403157 call 405fe8 400->404 405 4031bd-4031c1 400->405 410 4031cb-4031d1 404->410 422 403159-403160 404->422 409 4031c3-4031ca call 403019 405->409 405->410 409->410 415 4031e0-4031e8 410->415 416 4031d3-4031dd call 4069f7 410->416 415->388 423 4031ee 415->423 416->415 419->393 419->396 422->410 428 403162-403169 422->428 423->385 425 403277 424->425 426 40327d-403282 424->426 425->426 429 403283-403289 426->429 428->410 430 40316b-403172 428->430 429->429 431 40328b-4032a6 SetFilePointer call 405fe8 429->431 430->410 432 403174-40317b 430->432 436 4032ab 431->436 432->410 433 40317d-40319d 432->433 433->393 435 4031a3-4031a7 433->435 437 4031a9-4031ad 435->437 438 4031af-4031b7 435->438 436->378 437->423 437->438 438->410 439 4031b9-4031bb 438->439 439->410
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040308E
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Setup.exe,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA
                                                                                                                                                                                                                              • Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                                                              • Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,00441800,00441800,C:\Users\user\Desktop\Setup.exe,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\Setup.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
                                                                                                                                                                                                                            • API String ID: 2803837635-3037081627
                                                                                                                                                                                                                            • Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                                                                                                                            • Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D
                                                                                                                                                                                                                            Function 0040657A Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 196stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 440 40657a-406585 441 406587-406596 440->441 442 406598-4065ae 440->442 441->442 443 4065b0-4065bd 442->443 444 4065c6-4065cf 442->444 443->444 445 4065bf-4065c2 443->445 446 4065d5 444->446 447 4067aa-4067b5 444->447 445->444 448 4065da-4065e7 446->448 449 4067c0-4067c1 447->449 450 4067b7-4067bb call 40653d 447->450 448->447 451 4065ed-4065f6 448->451 450->449 453 406788 451->453 454 4065fc-406639 451->454 457 406796-406799 453->457 458 40678a-406794 453->458 455 40672c-406731 454->455 456 40663f-406646 454->456 462 406733-406739 455->462 463 406764-406769 455->463 459 406648-40664a 456->459 460 40664b-40664d 456->460 461 40679b-4067a4 457->461 458->461 459->460 464 40668a-40668d 460->464 465 40664f-406676 call 40640b 460->465 461->447 468 4065d7 461->468 469 406749-406755 call 40653d 462->469 470 40673b-406747 call 406484 462->470 466 406778-406786 lstrlenW 463->466 467 40676b-406773 call 40657a 463->467 474 40669d-4066a0 464->474 475 40668f-40669b GetSystemDirectoryW 464->475 485 406713-406717 465->485 486 40667c-406685 call 40657a 465->486 466->461 467->466 468->448 478 40675a-406760 469->478 470->478 481 4066a2-4066b0 GetWindowsDirectoryW 474->481 482 406709-40670b 474->482 480 40670d-406711 475->480 478->466 483 406762 478->483 480->485 487 406724-40672a call 4067c4 480->487 481->482 482->480 484 4066b2-4066ba 482->484 483->487 491 4066d1-4066e7 SHGetSpecialFolderLocation 484->491 492 4066bc-4066c5 484->492 485->487 488 406719-40671f lstrcatW 485->488 486->480 487->466 488->487 493 406705 491->493 494 4066e9-406703 SHGetPathFromIDListW CoTaskMemFree 491->494 497 4066cd-4066cf 492->497 493->482 494->480 494->493 497->480 497->491
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 00406695
                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00000000,00424420,74DF23A0), ref: 004066A8
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Directory$SystemWindowslstrcatlstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp$Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                                            • API String ID: 4260037668-3237294192
                                                                                                                                                                                                                            • Opcode ID: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
                                                                                                                                                                                                                            • Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D
                                                                                                                                                                                                                            Function 004032B4 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 166COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 562 4032b4-4032cb 563 4032d4-4032dd 562->563 564 4032cd 562->564 565 4032e6-4032eb 563->565 566 4032df 563->566 564->563 567 4032fb-403308 call 4034cf 565->567 568 4032ed-4032f6 call 4034e5 565->568 566->565 572 4034bd 567->572 573 40330e-403312 567->573 568->567 574 4034bf-4034c0 572->574 575 403468-40346a 573->575 576 403318-403361 GetTickCount 573->576 579 4034c8-4034cc 574->579 577 4034aa-4034ad 575->577 578 40346c-40346f 575->578 580 4034c5 576->580 581 403367-40336f 576->581 585 4034b2-4034bb call 4034cf 577->585 586 4034af 577->586 578->580 582 403471 578->582 580->579 583 403371 581->583 584 403374-403382 call 4034cf 581->584 588 403474-40347a 582->588 583->584 584->572 596 403388-403391 584->596 585->572 594 4034c2 585->594 586->585 591 40347c 588->591 592 40347e-40348c call 4034cf 588->592 591->592 592->572 599 40348e-40349a call 4060df 592->599 594->580 598 403397-4033b7 call 406a65 596->598 604 403460-403462 598->604 605 4033bd-4033d0 GetTickCount 598->605 606 403464-403466 599->606 607 40349c-4034a6 599->607 604->574 608 4033d2-4033da 605->608 609 40341b-40341d 605->609 606->574 607->588 614 4034a8 607->614 610 4033e2-403418 MulDiv wsprintfW call 40559f 608->610 611 4033dc-4033e0 608->611 612 403454-403458 609->612 613 40341f-403423 609->613 610->609 611->609 611->610 612->581 618 40345e 612->618 616 403425-40342c call 4060df 613->616 617 40343a-403445 613->617 614->580 622 403431-403433 616->622 621 403448-40344c 617->621 618->580 621->598 623 403452 621->623 622->606 624 403435-403438 622->624 623->580 624->621
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CountTick$wsprintf
                                                                                                                                                                                                                            • String ID: *B$ DB$ A$ A$... %d%%$tClientRect$}8@
                                                                                                                                                                                                                            • API String ID: 551687249-400812307
                                                                                                                                                                                                                            • Opcode ID: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
                                                                                                                                                                                                                            • Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9
                                                                                                                                                                                                                            Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 625 40176f-401794 call 402da6 call 405e83 630 401796-40179c call 40653d 625->630 631 40179e-4017b0 call 40653d call 405e0c lstrcatW 625->631 636 4017b5-4017b6 call 4067c4 630->636 631->636 640 4017bb-4017bf 636->640 641 4017c1-4017cb call 406873 640->641 642 4017f2-4017f5 640->642 649 4017dd-4017ef 641->649 650 4017cd-4017db CompareFileTime 641->650 643 4017f7-4017f8 call 406008 642->643 644 4017fd-401819 call 40602d 642->644 643->644 652 40181b-40181e 644->652 653 40188d-4018b6 call 40559f call 4032b4 644->653 649->642 650->649 654 401820-40185e call 40653d * 2 call 40657a call 40653d call 405b9d 652->654 655 40186f-401879 call 40559f 652->655 665 4018b8-4018bc 653->665 666 4018be-4018ca SetFileTime 653->666 654->640 687 401864-401865 654->687 667 401882-401888 655->667 665->666 669 4018d0-4018db CloseHandle 665->669 666->669 670 402c33 667->670 673 4018e1-4018e4 669->673 674 402c2a-402c2d 669->674 675 402c35-402c39 670->675 677 4018e6-4018f7 call 40657a lstrcatW 673->677 678 4018f9-4018fc call 40657a 673->678 674->670 684 401901-4023a2 call 405b9d 677->684 678->684 684->674 684->675 687->667 689 401867-401868 687->689 689->655
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(00000000,00000000,get,00441000,?,?,00000031), ref: 004017B0
                                                                                                                                                                                                                            • CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00441000,?,?,00000031), ref: 004017D5
                                                                                                                                                                                                                              • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\), ref: 0040560C
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsk2875.tmp$C:\Users\user\AppData\Local\Temp\nsk2875.tmp\inetc.dll$get
                                                                                                                                                                                                                            • API String ID: 1941528284-4040085173
                                                                                                                                                                                                                            • Opcode ID: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
                                                                                                                                                                                                                            • Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D
                                                                                                                                                                                                                            Function 0040559F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 691 40559f-4055b4 692 4055ba-4055cb 691->692 693 40566b-40566f 691->693 694 4055d6-4055e2 lstrlenW 692->694 695 4055cd-4055d1 call 40657a 692->695 697 4055e4-4055f4 lstrlenW 694->697 698 4055ff-405603 694->698 695->694 697->693 699 4055f6-4055fa lstrcatW 697->699 700 405612-405616 698->700 701 405605-40560c SetWindowTextW 698->701 699->698 702 405618-40565a SendMessageW * 3 700->702 703 40565c-40565e 700->703 701->700 702->703 703->693 704 405660-405663 703->704 704->693
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                                                            • SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\), ref: 0040560C
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSendlstrlen$lstrcat$TextWindow
                                                                                                                                                                                                                            • String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\
                                                                                                                                                                                                                            • API String ID: 1495540970-226564743
                                                                                                                                                                                                                            • Opcode ID: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
                                                                                                                                                                                                                            • Instruction ID: 138a2a903332092674924c4fce2a37a83712bc812e9b86ab44911e1df8857bb6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1219071900558BACF11AFA9DD84DDFBF75EF45354F14803AF904B22A0C7794A419F68
                                                                                                                                                                                                                            Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 705 4026ec-402705 call 402d84 708 402c2a-402c2d 705->708 709 40270b-402712 705->709 710 402c33-402c39 708->710 711 402714 709->711 712 402717-40271a 709->712 711->712 713 402720-40272f call 40649d 712->713 714 40287e-402886 712->714 713->714 718 402735 713->718 714->708 719 40273b-40273f 718->719 720 4027d4-4027d7 719->720 721 402745-402760 ReadFile 719->721 723 4027d9-4027dc 720->723 724 4027ef-4027ff call 4060b0 720->724 721->714 722 402766-40276b 721->722 722->714 726 402771-40277f 722->726 723->724 727 4027de-4027e9 call 40610e 723->727 724->714 733 402801 724->733 730 402785-402797 MultiByteToWideChar 726->730 731 40283a-402846 call 406484 726->731 727->714 727->724 730->733 734 402799-40279c 730->734 731->710 736 402804-402807 733->736 737 40279e-4027a9 734->737 736->731 739 402809-40280e 736->739 737->736 740 4027ab-4027d0 SetFilePointer MultiByteToWideChar 737->740 741 402810-402815 739->741 742 40284b-40284f 739->742 740->737 743 4027d2 740->743 741->742 746 402817-40282a 741->746 744 402851-402855 742->744 745 40286c-402878 SetFilePointer 742->745 743->733 747 402857-40285b 744->747 748 40285d-40286a 744->748 745->714 746->714 749 40282c-402832 746->749 747->745 747->748 748->714 749->719 750 402838 749->750 750->714
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ReadFile.KERNEL32(?,?,?,?), ref: 00402758
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
                                                                                                                                                                                                                              • Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                            • String ID: 9
                                                                                                                                                                                                                            • API String ID: 163830602-2366072709
                                                                                                                                                                                                                            • Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                                                                                                                            • Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58
                                                                                                                                                                                                                            Function 0040689A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 751 40689a-4068ba GetSystemDirectoryW 752 4068bc 751->752 753 4068be-4068c0 751->753 752->753 754 4068d1-4068d3 753->754 755 4068c2-4068cb 753->755 757 4068d4-406907 wsprintfW LoadLibraryExW 754->757 755->754 756 4068cd-4068cf 755->756 756->757
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 004068EC
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                            • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                            • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                            • Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                                                                                                                            • Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8
                                                                                                                                                                                                                            Function 00405A6E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 758 405a6e-405ab9 CreateDirectoryW 759 405abb-405abd 758->759 760 405abf-405acc GetLastError 758->760 761 405ae6-405ae8 759->761 760->761 762 405ace-405ae2 SetFileSecurityW 760->762 762->759 763 405ae4 GetLastError 762->763 763->761
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405AC5
                                                                                                                                                                                                                            • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405AE4
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                            • API String ID: 3449924974-3081826266
                                                                                                                                                                                                                            • Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                                                                                                                            • Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9
                                                                                                                                                                                                                            Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 764 401d81-401d85 765 401d94-401d9a GetDlgItem 764->765 766 401d87-401d92 call 402d84 764->766 767 401da0-401dcc 765->767 766->767 770 401dd7 767->770 771 401dce-401dd5 call 402da6 767->771 773 401ddb-401e31 GetClientRect LoadImageW SendMessageW 770->773 771->773 775 401e33-401e36 773->775 776 401e3f-401e42 773->776 775->776 777 401e38-401e39 DeleteObject 775->777 778 401e48 776->778 779 402c2a-402c39 776->779 777->776 778->779
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 00401D9A
                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 00401DE5
                                                                                                                                                                                                                            • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 00401E39
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1849352358-0
                                                                                                                                                                                                                            • Opcode ID: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
                                                                                                                                                                                                                            • Instruction ID: b69f8f45c5cbb28dd5603d9b1d667d2ce3d3910c133b75fee4ecc707c572ca23
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3321F672904119AFCB05DBA4DE45AEEBBB5EF08314F14003AFA45F62A0DB389951DB98
                                                                                                                                                                                                                            Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 782 401c43-401c63 call 402d84 * 2 787 401c65-401c6c call 402da6 782->787 788 401c6f-401c73 782->788 787->788 790 401c75-401c7c call 402da6 788->790 791 401c7f-401c85 788->791 790->791 794 401cd3-401cfd call 402da6 * 2 FindWindowExW 791->794 795 401c87-401ca3 call 402d84 * 2 791->795 805 401d03 794->805 806 401cc3-401cd1 SendMessageW 795->806 807 401ca5-401cc1 SendMessageTimeoutW 795->807 808 401d06-401d09 805->808 806->805 807->808 809 402c2a-402c39 808->809 810 401d0f 808->810 810->809
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Timeout
                                                                                                                                                                                                                            • String ID: !
                                                                                                                                                                                                                            • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                            • Opcode ID: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
                                                                                                                                                                                                                            • Instruction ID: 549e056fbb7746b1afa8e7352ee9f1cbf83a3633853e14f9ff1f16dc1dd81c22
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 46219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98
                                                                                                                                                                                                                            Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk2875.tmp,00000023,00000011,00000002), ref: 004024D5
                                                                                                                                                                                                                            • RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsk2875.tmp,00000000,00000011,00000002), ref: 00402515
                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsk2875.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseValuelstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsk2875.tmp
                                                                                                                                                                                                                            • API String ID: 2655323295-2864322385
                                                                                                                                                                                                                            • Opcode ID: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
                                                                                                                                                                                                                            • Instruction ID: a32c4fc66ba480c3aafb49ec1434dbeb720bd0d2787204a1d049ba7b64bbfaa1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8B118E71E00119BEEF10AFA5DE49EAEBAB8FF44358F15443AF504F61C1D7B88D40AA58
                                                                                                                                                                                                                            Function 00405F14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                            • String ID: C:\$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                            • API String ID: 3248276644-3049482934
                                                                                                                                                                                                                            • Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                                                                                                                            • Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE
                                                                                                                                                                                                                            Function 0040605C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040607A
                                                                                                                                                                                                                            • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CountFileNameTempTick
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                                            • API String ID: 1716503409-678247507
                                                                                                                                                                                                                            • Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                                                                                                                            • Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768
                                                                                                                                                                                                                            Function 00403B57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,74DF3420,00000000,C:\Users\user\AppData\Local\Temp\,00403B2F,00403A5E,?), ref: 00403B71
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00403B78
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00403B57
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                            • API String ID: 1100898210-3081826266
                                                                                                                                                                                                                            • Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
                                                                                                                                                                                                                            • Instruction ID: 19c5699a9bb8b3376c06320bd1355d3f7d45777e2bc9a3354ca833756e7661a4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 40E0EC3290212097C7615F55FE08B6E7B78AF49B26F05056AE884BB2628B746D428BDC
                                                                                                                                                                                                                            Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103
                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\), ref: 0040560C
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 334405425-0
                                                                                                                                                                                                                            • Opcode ID: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
                                                                                                                                                                                                                            • Instruction ID: d1cf9917c249e547a3b1759614bc69e8b445b1996c4dbd71fd6f6dd46acd7470
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A21C231904104FACF11AFA5CE48A9D7A71BF48358F20413BF605B91E1DBBD8A82965D
                                                                                                                                                                                                                            Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(02C0CA70), ref: 00401C0B
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D
                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global$AllocFreelstrcatlstrlen
                                                                                                                                                                                                                            • String ID: get
                                                                                                                                                                                                                            • API String ID: 3292104215-4248514160
                                                                                                                                                                                                                            • Opcode ID: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
                                                                                                                                                                                                                            • Instruction ID: 7c0f58a685d1fc6dd3685da305ee1819882fb4420ac17dc2787245939102450a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B21D872904210EBDB20AFA8EE84A5E73B4EB04715755063BF552F72D0D7B8AC414B9D
                                                                                                                                                                                                                            Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
                                                                                                                                                                                                                            • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsk2875.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Enum$CloseValue
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 397863658-0
                                                                                                                                                                                                                            • Opcode ID: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
                                                                                                                                                                                                                            • Instruction ID: 08080f496e1fbaad801da7c4a2f11cdf7a22a5a493a276a89d416976773fa01e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 89017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61C0EBB85E44966D
                                                                                                                                                                                                                            Function 00405C01 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00406008: GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
                                                                                                                                                                                                                              • Part of subcall function 00406008: SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021
                                                                                                                                                                                                                            • RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C1C
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C24
                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C3C
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1655745494-0
                                                                                                                                                                                                                            • Opcode ID: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
                                                                                                                                                                                                                            • Instruction ID: 0274c5225d47ddc366315f3a2fda4b694ad97aa72442a0e2fcdbaf00fd257d87
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F4E0E53110CF9156E61457309E08F5F2AD8EF86715F05493EF892B10C0CBB848068E6A
                                                                                                                                                                                                                            Function 00404472 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageW.USER32(00000408,?,00000000,004040D1), ref: 00404490
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                            • String ID: x
                                                                                                                                                                                                                            • API String ID: 3850602802-2363233923
                                                                                                                                                                                                                            • Opcode ID: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
                                                                                                                                                                                                                            • Instruction ID: 1b38e0d23eed931a714c5b599c5829f4d2050063c4158495342b67dc2c27a344
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10C01271140200EACB004B00DE01F0A7A20B7A0B02F209039F381210B087B05422DB0C
                                                                                                                                                                                                                            Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                                                              • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                                                              • Part of subcall function 00405A6E: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(?,00441000,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1892508949-0
                                                                                                                                                                                                                            • Opcode ID: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
                                                                                                                                                                                                                            • Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E
                                                                                                                                                                                                                            Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsk2875.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3356406503-0
                                                                                                                                                                                                                            • Opcode ID: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
                                                                                                                                                                                                                            • Instruction ID: 3e5dab0bbcc9b7b4348569693e39c51bc0b27c59e8ea0ed6abb05ebc10b9b344
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F116D71900219EADF14DFA4DA589AE77B4FF04345B20443BE401B62C0E7B88A45EB5D
                                                                                                                                                                                                                            Function 00401F12 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00405B63: ShellExecuteExW.SHELL32(?), ref: 00405B72
                                                                                                                                                                                                                              • Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
                                                                                                                                                                                                                              • Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCodeExecuteExitHandleObjectProcessShellSingleWait
                                                                                                                                                                                                                            • String ID: @
                                                                                                                                                                                                                            • API String ID: 165873841-2766056989
                                                                                                                                                                                                                            • Opcode ID: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
                                                                                                                                                                                                                            • Instruction ID: 706d8f23dd4fc365793d21c3b3cee38f3579e955c6bce5a1691758ef83551cc9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20115B71E042189ADB50EFB9CA49B8CB6F4BF04304F24447AE405F72C1EBBC89459B18
                                                                                                                                                                                                                            Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                            • Opcode ID: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                                                                                                                            • Instruction ID: f98c5e72cab4da6dd47fcf147c12dc0649e5852bd482257a86ca63d172a8b8d6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0B01F4316202209FE7094B389D05B6A3698E710319F14823FF851F65F1EA78DC029B4C
                                                                                                                                                                                                                            Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000000), ref: 00401EFC
                                                                                                                                                                                                                            • EnableWindow.USER32(00000000,00000000), ref: 00401F07
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$EnableShow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1136574915-0
                                                                                                                                                                                                                            • Opcode ID: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
                                                                                                                                                                                                                            • Instruction ID: ff95e9915c8c9942b49c08d49a5710ecdabad47c7be9b03b7ba0a01474a23479
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7E04872908211CFE705EBA4EE495AD77F4EF40325710497FE501F11D1DBB55D00965D
                                                                                                                                                                                                                            Function 00405B20 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 00405B56
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3712363035-0
                                                                                                                                                                                                                            • Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
                                                                                                                                                                                                                            • Instruction ID: 0547baa0b497a95b6ed0e8f273b1969b1ac2c9598ef2001c301bcde660c6e2d6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3EE092B4600209BFEB10AB64AE49F7B7AACEB04704F004565BA51E61A1DB78E8158A78
                                                                                                                                                                                                                            Function 0040690A Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                                                                                                                              • Part of subcall function 0040689A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                                                                                                                              • Part of subcall function 0040689A: wsprintfW.USER32 ref: 004068EC
                                                                                                                                                                                                                              • Part of subcall function 0040689A: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2547128583-0
                                                                                                                                                                                                                            • Opcode ID: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
                                                                                                                                                                                                                            • Instruction ID: 98bdf7d71c6046f852b78b75196177710d0a141037308efd39b2ac7baa162fea
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9FE0867390422066D21196745D44D7773A89B99750306443EF946F2090DB38DC31A76E
                                                                                                                                                                                                                            Function 00402C05 Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000000B,00000001), ref: 00402C14
                                                                                                                                                                                                                            • InvalidateRect.USER32(?), ref: 00402C24
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: InvalidateMessageRectSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 909852535-0
                                                                                                                                                                                                                            • Opcode ID: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
                                                                                                                                                                                                                            • Instruction ID: 5efb85e177e5feb05262591b5578bbf68be0fc1facb886aaf0ec985341d6bcc2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CEE08C72700008FFEB01CBA4EE84DAEB779FB40315B00007AF502A00A0D7300D40DA28
                                                                                                                                                                                                                            Function 0040602D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$AttributesCreate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 415043291-0
                                                                                                                                                                                                                            • Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                                                                                                                            • Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15
                                                                                                                                                                                                                            Function 00406008 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AttributesFile
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3188754299-0
                                                                                                                                                                                                                            • Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                            • Instruction ID: c979a2e86073268fb5c10017c0603d576bb262e7e1663e1e1b2ee048d1a5e24b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 34D012725041316FC2102728EF0C89BBF55EF643717014B35F9A5A22F0CB304C638A98
                                                                                                                                                                                                                            Function 00403B12 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(FFFFFFFF,00403A5E,?), ref: 00403B1D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\nsk2875.tmp\, xrefs: 00403B31
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseHandle
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\
                                                                                                                                                                                                                            • API String ID: 2962429428-2887330087
                                                                                                                                                                                                                            • Opcode ID: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
                                                                                                                                                                                                                            • Instruction ID: 74b342ff74dc5917d60848dc34610585f5de2c5243f802b65b47dd8438b48b4d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5EC0123050470056D1646F749E4FE153B64AB4073EB600325B0F9B10F1CB3C5759895D
                                                                                                                                                                                                                            Function 00405AEB Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405AFF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1375471231-0
                                                                                                                                                                                                                            • Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                                                                                                                            • Instruction ID: 33feed20cbbf131019f18849f7ccc9358209a8d33535326e0157453b6049084a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1BC04C30204501AED6105B609E48B177AA4DB50741F16843D6146E41E0DA789455EE2D
                                                                                                                                                                                                                            Function 00402891 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,?,00000000,?,?), ref: 004028AF
                                                                                                                                                                                                                              • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FilePointerwsprintf
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 327478801-0
                                                                                                                                                                                                                            • Opcode ID: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                                                                                                                            • Instruction ID: a13d1cf18dcce6f7d85bed0b4e0fde0de6b16079219dfacd376ffc086bc6f252
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3E09271A04105BFDB01EFA5AE499AEB3B8EF44319B10483BF102F00C1DA794D119B2D
                                                                                                                                                                                                                            Function 004063D8 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 00406401
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Create
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2289755597-0
                                                                                                                                                                                                                            • Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                            • Instruction ID: ccab944935cfefb85f0e849ce69279fb55db75a3b7fb0960311cd9d36817041a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04E0E6B2010109BFEF095F90DC0AD7B3B1DE704300F01892EFD06D4091E6B5AD306675
                                                                                                                                                                                                                            Function 004060DF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403498,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 004060F3
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileWrite
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3934441357-0
                                                                                                                                                                                                                            • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                            • Instruction ID: d8d859634201a592f38c73999a999f352708a9e59580de02994c407fa40ca669
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FAE08C3220026AABEF109E60DC04AEB3B6CFB00360F014837FA16E7081E270E93087A4
                                                                                                                                                                                                                            Function 004060B0 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E2,00000000,00000000,00403306,000000FF,00000004,00000000,00000000,00000000), ref: 004060C4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileRead
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2738559852-0
                                                                                                                                                                                                                            • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                            • Instruction ID: 1583d2e05e1cff28e3594e7db3f0db2d88eef65457287744bb544c492d9958e5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AEE0EC322502AAABDF10AE65DC04AEB7B6CEB05361F018936FD16E6150E631E92197A4
                                                                                                                                                                                                                            Function 004063AA Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00406438,?,00000000,?,?,Remove folder: ,?), ref: 004063CE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Open
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 71445658-0
                                                                                                                                                                                                                            • Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                            • Instruction ID: 4361357c0318622cec318f667d88df30c4c29b75262f7bca7234b06b46464da2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83D0123210020EBBDF115F91AD01FAB3B5DAB08310F014426FE06E40A1D775D530A764
                                                                                                                                                                                                                            Function 00404499 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,?,00000000), ref: 004044B3
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemTextlstrcatlstrlen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 281422827-0
                                                                                                                                                                                                                            • Opcode ID: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
                                                                                                                                                                                                                            • Instruction ID: 6ac98b26730712a62f5b3967fa7f39b4c61dbbfa6ef1674fce18da22a1fc1fc0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3C08C35008200BFD641A714EC42F0FB7A8FFA031AF00C42EB05CA10D1C63494208A2A
                                                                                                                                                                                                                            Function 004044E5 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageW.USER32(0002045E,00000000,00000000,00000000), ref: 004044F7
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                            • Opcode ID: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
                                                                                                                                                                                                                            • Instruction ID: 729772cd993a62bf3dcd5a53f5ba0c6067f9c4589e443fe2cdcdd0dddf41cb53
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74C04CB1740605BADA108B509D45F0677546750701F188429B641A50E0CA74E410D62C
                                                                                                                                                                                                                            Function 00405B63 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ShellExecuteExW.SHELL32(?), ref: 00405B72
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExecuteShell
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 587946157-0
                                                                                                                                                                                                                            • Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
                                                                                                                                                                                                                            • Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29
                                                                                                                                                                                                                            Function 004044CE Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                            • Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                                                                                                                            • Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08
                                                                                                                                                                                                                            Function 004034E5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00403242,?,?,?,?,?,?,0040387D,?), ref: 004034F3
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FilePointer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 973152223-0
                                                                                                                                                                                                                            • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                            • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                                                                                                                                                                                                            Function 004044BB Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • KiUserCallbackDispatcher.NTDLL(?,00404292), ref: 004044C5
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2492992576-0
                                                                                                                                                                                                                            • Opcode ID: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
                                                                                                                                                                                                                            • Instruction ID: 0db23a64e3c973129ccb7351ad80e5cfa0365495cc8a336c35755b545d17f2be
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74A00275508601DBDE115B51DF09D057B71A7547017414579A18551034C6314461EB5D
                                                                                                                                                                                                                            Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                                                              • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\), ref: 0040560C
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                                                              • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                                                              • Part of subcall function 00405B20: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
                                                                                                                                                                                                                              • Part of subcall function 00405B20: CloseHandle.KERNEL32(?), ref: 00405B56
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                                                              • Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
                                                                                                                                                                                                                              • Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8
                                                                                                                                                                                                                              • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2972824698-0
                                                                                                                                                                                                                            • Opcode ID: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
                                                                                                                                                                                                                            • Instruction ID: a015d294fcb9cc4e365613bb9e09bf6e78b00889af70ee47f703a6c6056ea9c8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2DF09072904112EBCB21BBA59A84EDE76E8DF01318F25403BE102B21D1D77C4E429A6E

                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                            Function 0040498A Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FB), ref: 004049D9
                                                                                                                                                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00404A03
                                                                                                                                                                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 00404AB4
                                                                                                                                                                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00404ABF
                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(Remove folder: ,0042D268,00000000,?,?), ref: 00404AF1
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404AFD
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B0F
                                                                                                                                                                                                                              • Part of subcall function 00405B81: GetDlgItemTextW.USER32(?,?,00000400,00404B46), ref: 00405B94
                                                                                                                                                                                                                              • Part of subcall function 004067C4: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
                                                                                                                                                                                                                              • Part of subcall function 004067C4: CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
                                                                                                                                                                                                                              • Part of subcall function 004067C4: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
                                                                                                                                                                                                                              • Part of subcall function 004067C4: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E
                                                                                                                                                                                                                            • GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 00404BD2
                                                                                                                                                                                                                            • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BED
                                                                                                                                                                                                                              • Part of subcall function 00404D46: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
                                                                                                                                                                                                                              • Part of subcall function 00404D46: wsprintfW.USER32 ref: 00404DF0
                                                                                                                                                                                                                              • Part of subcall function 00404D46: SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                            • String ID: <?y$A$C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp$Remove folder:
                                                                                                                                                                                                                            • API String ID: 2624150263-4147959009
                                                                                                                                                                                                                            • Opcode ID: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
                                                                                                                                                                                                                            • Instruction ID: a81e8b8b6ddc8ea4f7a7a45a10ce21cc850824e22f7b82fba9ad49fead82d7d1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CBA191B1900208ABDB119FA6DD45AAFB7B8EF84314F10803BF601B62D1D77C9A41CB6D
                                                                                                                                                                                                                            Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateInstance
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 542301482-0
                                                                                                                                                                                                                            • Opcode ID: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
                                                                                                                                                                                                                            • Instruction ID: 5977cb51530078b600b156af0050786de557c4b464dd586e6a5beaa7a0440451
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A7411571A00208EFCF40DFE4C989E9D7BB5BF49348B20456AF905EB2D1DB799981CB94
                                                                                                                                                                                                                            Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFindFirst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1974802433-0
                                                                                                                                                                                                                            • Opcode ID: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
                                                                                                                                                                                                                            • Instruction ID: 3f6fbcf0fd4d311cdd608d5f72697756ed96b8559223cd5d9f1c4d92bc61f1b3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3CF08271A04105EFD701DBA4ED49AAEB378FF14314F60417BE116F21D0E7B88E159B29
                                                                                                                                                                                                                            Function 00406D85 Relevance: .3, Instructions: 334COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
                                                                                                                                                                                                                            • Instruction ID: 3db1d01f4341fbbb805040525b4c18df43ce82c239752998d09602440244d977
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FEE18A71A0070ADFCB24CF59D880BAABBF5FB44305F15852EE496A72D1D338AA91CF45
                                                                                                                                                                                                                            Function 0040755C Relevance: .3, Instructions: 300COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
                                                                                                                                                                                                                            • Instruction ID: 4d3fc1c80ea15bf86cc2801d6424e98614acddb7a54358772128df9d71e60e61
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6C14871E042599BCF18CF68C8905EEBBB2BF88314F25866AD85677380D7347941CF95
                                                                                                                                                                                                                            Function 00404F06 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F9), ref: 00404F1E
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000408), ref: 00404F29
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 00404F73
                                                                                                                                                                                                                            • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F8A
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000FC,00405513), ref: 00404FA3
                                                                                                                                                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB7
                                                                                                                                                                                                                            • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FC9
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001109,00000002), ref: 00404FDF
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FEB
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFD
                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 00405000
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102
                                                                                                                                                                                                                              • Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00405144
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000005), ref: 00405162
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000419,00000000,?), ref: 0040525D
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C2
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052D7
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FB
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040531B
                                                                                                                                                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 00405330
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00405340
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053B9
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001102,?,?), ref: 00405462
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405471
                                                                                                                                                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 0040549C
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000000), ref: 004054EA
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FE), ref: 004054F5
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 004054FC
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                            • String ID: $M$N
                                                                                                                                                                                                                            • API String ID: 2564846305-813528018
                                                                                                                                                                                                                            • Opcode ID: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
                                                                                                                                                                                                                            • Instruction ID: 669472b6e39b4296dbb294a81ed98d86f32f22d8abeb4cff7518c6a892085abf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EF028A70900608EFDB20DFA9DD45AAF7BB5FB84314F10817AE610BA2E0D7799942DF58
                                                                                                                                                                                                                            Function 00404658 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046F6
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 0040470A
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404727
                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 00404738
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404746
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404754
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?), ref: 00404759
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404766
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040477B
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,0000040A), ref: 004047D4
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000), ref: 004047DB
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 00404806
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404849
                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00404857
                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 0040485A
                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 00404873
                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 00404876
                                                                                                                                                                                                                            • SendMessageW.USER32(00000111,00000001,00000000), ref: 004048A5
                                                                                                                                                                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B7
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                                                            • String ID: <?y$N$Remove folder:
                                                                                                                                                                                                                            • API String ID: 3103080414-2699914115
                                                                                                                                                                                                                            • Opcode ID: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
                                                                                                                                                                                                                            • Instruction ID: e0aa441e67ff77812dea5cfa76c138b5706349c0d06c8e95e02877fce1cb63d1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A61A3B5900209BFDB10AF60DD85E6A7BA9FB44314F00843AFB05B62D0D778A951DF98
                                                                                                                                                                                                                            Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                            • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                            • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                            • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                            • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                            • DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                            • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                            • String ID: F
                                                                                                                                                                                                                            • API String ID: 941294808-1304234792
                                                                                                                                                                                                                            • Opcode ID: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
                                                                                                                                                                                                                            • Instruction ID: e457e53e67a16f607b198c8be77aa7e47a8fd9e6aa67a1a07366d16d1d2d9a76
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0E418B71800209AFCF058FA5DE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4
                                                                                                                                                                                                                            Function 00406183 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040631E,?,?), ref: 004061BE
                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061C7
                                                                                                                                                                                                                              • Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
                                                                                                                                                                                                                              • Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4
                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004061E4
                                                                                                                                                                                                                            • wsprintfA.USER32 ref: 00406202
                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 0040623D
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040624C
                                                                                                                                                                                                                            • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406284
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DA
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 004062EB
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F2
                                                                                                                                                                                                                              • Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                                                              • Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                                                            • String ID: %ls=%ls$[Rename]
                                                                                                                                                                                                                            • API String ID: 2171350718-461813615
                                                                                                                                                                                                                            • Opcode ID: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
                                                                                                                                                                                                                            • Instruction ID: 71978d88b6039f89b25a0dfa2ffa892efa56fbf884cfe692307f7793e751c739
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6A314670200716BBD2207B659D48F6B3A6CEF45754F15017EFA42F62C2EA3CA821867D
                                                                                                                                                                                                                            Function 00404500 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000EB), ref: 0040451D
                                                                                                                                                                                                                            • GetSysColor.USER32(00000000), ref: 0040455B
                                                                                                                                                                                                                            • SetTextColor.GDI32(?,00000000), ref: 00404567
                                                                                                                                                                                                                            • SetBkMode.GDI32(?,?), ref: 00404573
                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 00404586
                                                                                                                                                                                                                            • SetBkColor.GDI32(?,?), ref: 00404596
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 004045B0
                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(?), ref: 004045BA
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2320649405-0
                                                                                                                                                                                                                            • Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                            • Instruction ID: 19446832cb8519ea1938040ed984131457e28e93d0b00b9b4dc42373f0e33a15
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 382177B1500705AFCB31DF68DD08B5BBBF8AF41714B058A2EEA96B22E1C734E944CB54
                                                                                                                                                                                                                            Function 004067C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
                                                                                                                                                                                                                            • CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
                                                                                                                                                                                                                            • CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
                                                                                                                                                                                                                            • CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Char$Next$Prev
                                                                                                                                                                                                                            • String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                            • API String ID: 589700163-4010320282
                                                                                                                                                                                                                            • Opcode ID: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
                                                                                                                                                                                                                            • Instruction ID: 8e05d213a2b26a47bd0c986db1e6a85e10b5e067f284fb5e9645f7af11a9ce3c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7311862780161295DB313B158C44A77A2A8AF58798F56843FED86B32C1E77C8C9282AD
                                                                                                                                                                                                                            Function 00404E54 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E6F
                                                                                                                                                                                                                            • GetMessagePos.USER32 ref: 00404E77
                                                                                                                                                                                                                            • ScreenToClient.USER32(?,?), ref: 00404E91
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EA3
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC9
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                            • String ID: f
                                                                                                                                                                                                                            • API String ID: 41195575-1993550816
                                                                                                                                                                                                                            • Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                            • Instruction ID: 177f1d0b32132a6560496663958852c5fe6f1b23f9da62007dee57caca3d7f28
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 34014C71900219BADB00DBA4DD85BFFBBB8AB54711F10012BBA50B61C0D7B49A058BA5
                                                                                                                                                                                                                            Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDC.USER32(?), ref: 00401E51
                                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
                                                                                                                                                                                                                            • MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
                                                                                                                                                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00401E84
                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                                                              • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\,00000000), ref: 00406779
                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
                                                                                                                                                                                                                            • String ID: MS Shell Dlg
                                                                                                                                                                                                                            • API String ID: 2584051700-76309092
                                                                                                                                                                                                                            • Opcode ID: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
                                                                                                                                                                                                                            • Instruction ID: 78b13ae86a0973dc2b43aa2eb6c1af0beb3c1ef463c522f55250376beecb9f8a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7001B571904241EFEB005BB0EE49B9A3FB4BB15301F108A39F541B71D2C7B904458BED
                                                                                                                                                                                                                            Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
                                                                                                                                                                                                                            • MulDiv.KERNEL32(0002BCFB,00000064,0002E668), ref: 00402FDC
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00402FEC
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 00402FFC
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000406,?), ref: 0040300E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • verifying installer: %d%%, xrefs: 00402FE6
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                            • String ID: verifying installer: %d%%
                                                                                                                                                                                                                            • API String ID: 1451636040-82062127
                                                                                                                                                                                                                            • Opcode ID: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
                                                                                                                                                                                                                            • Instruction ID: eb17ebabde20c32bd565f0ca98bf5c3c7f8a04474e671541d9d17dad0456e96b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20014B7064020DABEF209F60DE4AFEA3B79FB04345F008039FA06B51D0DBB999559F69
                                                                                                                                                                                                                            Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00402A06
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00402A19
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2667972263-0
                                                                                                                                                                                                                            • Opcode ID: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
                                                                                                                                                                                                                            • Instruction ID: 8fc1a79e9ee36ebd610a2d663d7387b5f1fea8f48d7bc9e01940cd119f3fb53c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5831C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E0CB794C429BA8
                                                                                                                                                                                                                            Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
                                                                                                                                                                                                                            • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
                                                                                                                                                                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseEnum$DeleteValue
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1354259210-0
                                                                                                                                                                                                                            • Opcode ID: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
                                                                                                                                                                                                                            • Instruction ID: ca6229ec891c5908b4c2d3bab14ae3db7b9396451d72a40731f1c02386a45f13
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DA215A7150010ABBEF119F90CE89EEF7B7DEB50384F100076F909B21A0D7B49E54AA68
                                                                                                                                                                                                                            Function 00404D46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00404DF0
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                            • String ID: %u.%u%s%s
                                                                                                                                                                                                                            • API String ID: 3540041739-3551169577
                                                                                                                                                                                                                            • Opcode ID: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
                                                                                                                                                                                                                            • Instruction ID: d7f2b51e3f2153b105aad6c1cbcae815e44f670c765de83d30fbb221df5484fa
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AC11D573A041283BDB10656DAC45E9E369CAF81334F254237FA66F21D1EA78D91182E8
                                                                                                                                                                                                                            Function 00405EB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                                                            • CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                                                            • CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharNext
                                                                                                                                                                                                                            • String ID: C:\
                                                                                                                                                                                                                            • API String ID: 3213498283-3404278061
                                                                                                                                                                                                                            • Opcode ID: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
                                                                                                                                                                                                                            • Instruction ID: b7f7aa27055ddc775a1b47344aef2f77b81fec2ea34db2f3ccdabfa21b6bce3d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7BF0F631810E1296DB317B548C44E7B97BCEB64354B04843BD741B71C0D3BC8D808BDA
                                                                                                                                                                                                                            Function 00405E0C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E12
                                                                                                                                                                                                                            • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E1C
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,0040A014), ref: 00405E2E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405E0C
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                            • API String ID: 2659869361-3081826266
                                                                                                                                                                                                                            • Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                            • Instruction ID: 1a595bf39a0a3392b99637bd72bd9cca8666c17676e511d5d4bf90e80f698eee
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8D0A731101930BAC2127B49EC08DDF62ACAE89340341443BF145B30A4CB7C5E5187FD
                                                                                                                                                                                                                            Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsk2875.tmp\inetc.dll), ref: 00402695
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: lstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsk2875.tmp$C:\Users\user\AppData\Local\Temp\nsk2875.tmp\inetc.dll
                                                                                                                                                                                                                            • API String ID: 1659193697-323183610
                                                                                                                                                                                                                            • Opcode ID: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
                                                                                                                                                                                                                            • Instruction ID: edf8e5a6553ae7ef136857fb61bcac29e22bbc78049b19fa22ca3c34260198f3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2611EB71A00215BBCB10BFB18E4AAAE7665AF40744F25443FE002B71C2EAFC8891565E
                                                                                                                                                                                                                            Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DestroyWindow.USER32(00000000,00000000,004031F7,00000001,?,?,?,?,?,0040387D,?), ref: 0040302C
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040304A
                                                                                                                                                                                                                            • CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 00403067
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040387D,?), ref: 00403075
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2102729457-0
                                                                                                                                                                                                                            • Opcode ID: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
                                                                                                                                                                                                                            • Instruction ID: 3364d2369d767f53e7c05e99e54cbc9c067443d5da9c9f227d7c3a258cba7bb7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A9F08270702A20AFC2316F50FE4998B7F68FB44B56741447AF446B15ACCB380DA2CB9D
                                                                                                                                                                                                                            Function 00405513 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • IsWindowVisible.USER32(?), ref: 00405542
                                                                                                                                                                                                                            • CallWindowProcW.USER32(?,?,?,?), ref: 00405593
                                                                                                                                                                                                                              • Part of subcall function 004044E5: SendMessageW.USER32(0002045E,00000000,00000000,00000000), ref: 004044F7
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                            • Opcode ID: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                                                                                                                            • Instruction ID: 904a7c61355239921aaa7855b64c86422fca6e8886f64d9e6fcbc6a993ea73ec
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F3017CB1100608BFDF209F11DD80AAB3B27EB84754F50453AFA01762D5D77A8E92DA69
                                                                                                                                                                                                                            Function 0040640B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000000,?,00000000,?,?,Remove folder: ,?,?,00406672,80000002), ref: 00406451
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,00406672,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsk2875.tmp\), ref: 0040645C
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                            • String ID: Remove folder:
                                                                                                                                                                                                                            • API String ID: 3356406503-1958208860
                                                                                                                                                                                                                            • Opcode ID: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
                                                                                                                                                                                                                            • Instruction ID: a8d415a3dc4e4479eaaa65942f717852bb8bd3539c12dad3b2e52d491ce509ba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB017C72510209AADF21CF51CC09EDB3BB8FB54364F01803AFD5AA6190D738D968DBA8
                                                                                                                                                                                                                            Function 00405F92 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
                                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBA
                                                                                                                                                                                                                            • CharNextA.USER32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.1959466261.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959450461.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959484542.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959499810.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.1959642971.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 190613189-0
                                                                                                                                                                                                                            • Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                                                                                                                                                                                                            • Instruction ID: bd09551308ad338638525116890fdadd4ab1f465f5503068af61de479685a4e4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 34F0C231604418FFC7029BA5CD0099EBBA8EF06250B2140AAF840FB210D678DE019BA9

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:20.1%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:0%
                                                                                                                                                                                                                            Total number of Nodes:1386
                                                                                                                                                                                                                            Total number of Limit Nodes:31
                                                                                                                                                                                                                            execution_graph 3224 403640 SetErrorMode GetVersionExW 3225 403692 GetVersionExW 3224->3225 3226 4036ca 3224->3226 3225->3226 3227 403723 3226->3227 3228 406a35 5 API calls 3226->3228 3314 4069c5 GetSystemDirectoryW 3227->3314 3228->3227 3230 403739 lstrlenA 3230->3227 3231 403749 3230->3231 3317 406a35 GetModuleHandleA 3231->3317 3234 406a35 5 API calls 3235 403757 3234->3235 3236 406a35 5 API calls 3235->3236 3237 403763 #17 OleInitialize SHGetFileInfoW 3236->3237 3323 406668 lstrcpynW 3237->3323 3240 4037b0 GetCommandLineW 3324 406668 lstrcpynW 3240->3324 3242 4037c2 3325 405f64 3242->3325 3245 4038f7 3246 40390b GetTempPathW 3245->3246 3329 40360f 3246->3329 3248 403923 3250 403927 GetWindowsDirectoryW lstrcatW 3248->3250 3251 40397d DeleteFileW 3248->3251 3249 405f64 CharNextW 3253 4037f9 3249->3253 3254 40360f 12 API calls 3250->3254 3339 4030d0 GetTickCount GetModuleFileNameW 3251->3339 3253->3245 3253->3249 3258 4038f9 3253->3258 3256 403943 3254->3256 3255 403990 3259 403b6c ExitProcess CoUninitialize 3255->3259 3261 403a45 3255->3261 3268 405f64 CharNextW 3255->3268 3256->3251 3257 403947 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3256->3257 3260 40360f 12 API calls 3257->3260 3426 406668 lstrcpynW 3258->3426 3263 403b91 3259->3263 3264 403b7c 3259->3264 3267 403975 3260->3267 3369 403d17 3261->3369 3265 403b99 GetCurrentProcess OpenProcessToken 3263->3265 3266 403c0f ExitProcess 3263->3266 3480 405cc8 3264->3480 3271 403bb0 LookupPrivilegeValueW AdjustTokenPrivileges 3265->3271 3272 403bdf 3265->3272 3267->3251 3267->3259 3283 4039b2 3268->3283 3271->3272 3276 406a35 5 API calls 3272->3276 3273 403a54 3273->3259 3279 403be6 3276->3279 3277 403a1b 3427 40603f 3277->3427 3278 403a5c 3443 405c33 3278->3443 3281 403bfb ExitWindowsEx 3279->3281 3285 403c08 3279->3285 3281->3266 3281->3285 3283->3277 3283->3278 3484 40140b 3285->3484 3288 403a72 lstrcatW 3289 403a7d lstrcatW lstrcmpiW 3288->3289 3289->3273 3290 403a9d 3289->3290 3292 403aa2 3290->3292 3293 403aa9 3290->3293 3446 405b99 CreateDirectoryW 3292->3446 3451 405c16 CreateDirectoryW 3293->3451 3294 403a3a 3442 406668 lstrcpynW 3294->3442 3299 403aae SetCurrentDirectoryW 3300 403ac0 3299->3300 3301 403acb 3299->3301 3454 406668 lstrcpynW 3300->3454 3455 406668 lstrcpynW 3301->3455 3306 403b19 CopyFileW 3310 403ad8 3306->3310 3307 403b63 3309 406428 36 API calls 3307->3309 3309->3273 3310->3307 3311 4066a5 17 API calls 3310->3311 3313 403b4d CloseHandle 3310->3313 3456 4066a5 3310->3456 3473 406428 MoveFileExW 3310->3473 3477 405c4b CreateProcessW 3310->3477 3311->3310 3313->3310 3315 4069e7 wsprintfW LoadLibraryExW 3314->3315 3315->3230 3318 406a51 3317->3318 3319 406a5b GetProcAddress 3317->3319 3320 4069c5 3 API calls 3318->3320 3321 403750 3319->3321 3322 406a57 3320->3322 3321->3234 3322->3319 3322->3321 3323->3240 3324->3242 3326 405f6a 3325->3326 3327 4037e8 CharNextW 3326->3327 3328 405f71 CharNextW 3326->3328 3327->3253 3328->3326 3487 4068ef 3329->3487 3331 403625 3331->3248 3332 40361b 3332->3331 3496 405f37 lstrlenW CharPrevW 3332->3496 3335 405c16 2 API calls 3336 403633 3335->3336 3499 406187 3336->3499 3503 406158 GetFileAttributesW CreateFileW 3339->3503 3341 403113 3368 403120 3341->3368 3504 406668 lstrcpynW 3341->3504 3343 403136 3505 405f83 lstrlenW 3343->3505 3347 403147 GetFileSize 3348 403241 3347->3348 3367 40315e 3347->3367 3510 40302e 3348->3510 3352 403286 GlobalAlloc 3355 40329d 3352->3355 3354 4032de 3356 40302e 32 API calls 3354->3356 3359 406187 2 API calls 3355->3359 3356->3368 3357 403267 3358 4035e2 ReadFile 3357->3358 3360 403272 3358->3360 3362 4032ae CreateFileW 3359->3362 3360->3352 3360->3368 3361 40302e 32 API calls 3361->3367 3363 4032e8 3362->3363 3362->3368 3525 4035f8 SetFilePointer 3363->3525 3365 4032f6 3526 403371 3365->3526 3367->3348 3367->3354 3367->3361 3367->3368 3541 4035e2 3367->3541 3368->3255 3370 406a35 5 API calls 3369->3370 3371 403d2b 3370->3371 3372 403d31 3371->3372 3373 403d43 3371->3373 3596 4065af wsprintfW 3372->3596 3597 406536 3373->3597 3377 403d92 lstrcatW 3378 403d41 3377->3378 3588 403fed 3378->3588 3379 406536 3 API calls 3379->3377 3382 40603f 18 API calls 3383 403dc4 3382->3383 3384 403e58 3383->3384 3386 406536 3 API calls 3383->3386 3385 40603f 18 API calls 3384->3385 3387 403e5e 3385->3387 3393 403df6 3386->3393 3388 403e6e LoadImageW 3387->3388 3389 4066a5 17 API calls 3387->3389 3390 403f14 3388->3390 3391 403e95 RegisterClassW 3388->3391 3389->3388 3395 40140b 2 API calls 3390->3395 3394 403ecb SystemParametersInfoW CreateWindowExW 3391->3394 3424 403f1e 3391->3424 3392 403e17 lstrlenW 3397 403e25 lstrcmpiW 3392->3397 3398 403e4b 3392->3398 3393->3384 3393->3392 3396 405f64 CharNextW 3393->3396 3394->3390 3399 403f1a 3395->3399 3400 403e14 3396->3400 3397->3398 3401 403e35 GetFileAttributesW 3397->3401 3402 405f37 3 API calls 3398->3402 3404 403fed 18 API calls 3399->3404 3399->3424 3400->3392 3403 403e41 3401->3403 3405 403e51 3402->3405 3403->3398 3406 405f83 2 API calls 3403->3406 3407 403f2b 3404->3407 3602 406668 lstrcpynW 3405->3602 3406->3398 3409 403f37 ShowWindow 3407->3409 3410 403fba 3407->3410 3411 4069c5 3 API calls 3409->3411 3603 40579d OleInitialize 3410->3603 3413 403f4f 3411->3413 3415 403f5d GetClassInfoW 3413->3415 3418 4069c5 3 API calls 3413->3418 3414 403fc0 3416 403fc4 3414->3416 3417 403fdc 3414->3417 3420 403f71 GetClassInfoW RegisterClassW 3415->3420 3421 403f87 DialogBoxParamW 3415->3421 3422 40140b 2 API calls 3416->3422 3416->3424 3419 40140b 2 API calls 3417->3419 3418->3415 3419->3424 3420->3421 3423 40140b 2 API calls 3421->3423 3422->3424 3425 403faf 3423->3425 3424->3273 3425->3424 3426->3246 3625 406668 lstrcpynW 3427->3625 3429 406050 3626 405fe2 CharNextW CharNextW 3429->3626 3432 403a27 3432->3259 3441 406668 lstrcpynW 3432->3441 3433 4068ef 5 API calls 3439 406066 3433->3439 3434 406097 lstrlenW 3435 4060a2 3434->3435 3434->3439 3436 405f37 3 API calls 3435->3436 3438 4060a7 GetFileAttributesW 3436->3438 3438->3432 3439->3432 3439->3434 3440 405f83 2 API calls 3439->3440 3632 40699e FindFirstFileW 3439->3632 3440->3434 3441->3294 3442->3261 3444 406a35 5 API calls 3443->3444 3445 403a61 lstrcatW 3444->3445 3445->3288 3445->3289 3447 403aa7 3446->3447 3448 405bea GetLastError 3446->3448 3447->3299 3448->3447 3449 405bf9 SetFileSecurityW 3448->3449 3449->3447 3450 405c0f GetLastError 3449->3450 3450->3447 3452 405c2a GetLastError 3451->3452 3453 405c26 3451->3453 3452->3453 3453->3299 3454->3301 3455->3310 3460 4066b2 3456->3460 3457 4068d5 3458 403b0d DeleteFileW 3457->3458 3637 406668 lstrcpynW 3457->3637 3458->3306 3458->3310 3460->3457 3461 4068a3 lstrlenW 3460->3461 3462 4067ba GetSystemDirectoryW 3460->3462 3465 406536 3 API calls 3460->3465 3466 4066a5 10 API calls 3460->3466 3467 4067cd GetWindowsDirectoryW 3460->3467 3468 406844 lstrcatW 3460->3468 3469 4066a5 10 API calls 3460->3469 3470 4068ef 5 API calls 3460->3470 3471 4067fc SHGetSpecialFolderLocation 3460->3471 3635 4065af wsprintfW 3460->3635 3636 406668 lstrcpynW 3460->3636 3461->3460 3462->3460 3465->3460 3466->3461 3467->3460 3468->3460 3469->3460 3470->3460 3471->3460 3472 406814 SHGetPathFromIDListW CoTaskMemFree 3471->3472 3472->3460 3474 406449 3473->3474 3475 40643c 3473->3475 3474->3310 3638 4062ae 3475->3638 3478 405c8a 3477->3478 3479 405c7e CloseHandle 3477->3479 3478->3310 3479->3478 3483 405cdd 3480->3483 3481 403b89 ExitProcess 3482 405cf1 MessageBoxIndirectW 3482->3481 3483->3481 3483->3482 3485 401389 2 API calls 3484->3485 3486 401420 3485->3486 3486->3266 3488 4068fc 3487->3488 3490 406972 3488->3490 3491 406965 CharNextW 3488->3491 3493 405f64 CharNextW 3488->3493 3494 406951 CharNextW 3488->3494 3495 406960 CharNextW 3488->3495 3489 406977 CharPrevW 3489->3490 3490->3489 3492 406998 3490->3492 3491->3488 3491->3490 3492->3332 3493->3488 3494->3488 3495->3491 3497 405f53 lstrcatW 3496->3497 3498 40362d 3496->3498 3497->3498 3498->3335 3500 406194 GetTickCount GetTempFileNameW 3499->3500 3501 40363e 3500->3501 3502 4061ca 3500->3502 3501->3248 3502->3500 3502->3501 3503->3341 3504->3343 3506 405f91 3505->3506 3507 40313c 3506->3507 3508 405f97 CharPrevW 3506->3508 3509 406668 lstrcpynW 3507->3509 3508->3506 3508->3507 3509->3347 3511 403057 3510->3511 3512 40303f 3510->3512 3514 403067 GetTickCount 3511->3514 3515 40305f 3511->3515 3513 403048 DestroyWindow 3512->3513 3518 40304f 3512->3518 3513->3518 3517 403075 3514->3517 3514->3518 3545 406a71 3515->3545 3519 4030aa CreateDialogParamW ShowWindow 3517->3519 3520 40307d 3517->3520 3518->3352 3518->3368 3544 4035f8 SetFilePointer 3518->3544 3519->3518 3520->3518 3549 403012 3520->3549 3522 40308b wsprintfW 3552 4056ca 3522->3552 3525->3365 3527 403380 SetFilePointer 3526->3527 3528 40339c 3526->3528 3527->3528 3563 403479 GetTickCount 3528->3563 3533 403479 42 API calls 3534 4033d3 3533->3534 3535 40343f ReadFile 3534->3535 3539 4033e2 3534->3539 3540 403439 3534->3540 3535->3540 3537 4061db ReadFile 3537->3539 3539->3537 3539->3540 3578 40620a WriteFile 3539->3578 3540->3368 3542 4061db ReadFile 3541->3542 3543 4035f5 3542->3543 3543->3367 3544->3357 3546 406a8e PeekMessageW 3545->3546 3547 406a84 DispatchMessageW 3546->3547 3548 406a9e 3546->3548 3547->3546 3548->3518 3550 403021 3549->3550 3551 403023 MulDiv 3549->3551 3550->3551 3551->3522 3553 4056e5 3552->3553 3554 4030a8 3552->3554 3555 405701 lstrlenW 3553->3555 3556 4066a5 17 API calls 3553->3556 3554->3518 3557 40572a 3555->3557 3558 40570f lstrlenW 3555->3558 3556->3555 3559 405730 SetWindowTextW 3557->3559 3560 40573d 3557->3560 3558->3554 3561 405721 lstrcatW 3558->3561 3559->3560 3560->3554 3562 405743 SendMessageW SendMessageW SendMessageW 3560->3562 3561->3557 3562->3554 3564 4035d1 3563->3564 3565 4034a7 3563->3565 3566 40302e 32 API calls 3564->3566 3580 4035f8 SetFilePointer 3565->3580 3573 4033a3 3566->3573 3568 4034b2 SetFilePointer 3572 4034d7 3568->3572 3569 4035e2 ReadFile 3569->3572 3571 40302e 32 API calls 3571->3572 3572->3569 3572->3571 3572->3573 3574 40620a WriteFile 3572->3574 3575 4035b2 SetFilePointer 3572->3575 3581 406bb0 3572->3581 3573->3540 3576 4061db ReadFile 3573->3576 3574->3572 3575->3564 3577 4033bc 3576->3577 3577->3533 3577->3540 3579 406228 3578->3579 3579->3539 3580->3568 3582 406bd5 3581->3582 3583 406bdd 3581->3583 3582->3572 3583->3582 3584 406c64 GlobalFree 3583->3584 3585 406c6d GlobalAlloc 3583->3585 3586 406ce4 GlobalAlloc 3583->3586 3587 406cdb GlobalFree 3583->3587 3584->3585 3585->3582 3585->3583 3586->3582 3586->3583 3587->3586 3589 404001 3588->3589 3610 4065af wsprintfW 3589->3610 3591 404072 3611 4040a6 3591->3611 3593 403da2 3593->3382 3594 404077 3594->3593 3595 4066a5 17 API calls 3594->3595 3595->3594 3596->3378 3614 4064d5 3597->3614 3600 403d73 3600->3377 3600->3379 3601 40656a RegQueryValueExW RegCloseKey 3601->3600 3602->3384 3618 404610 3603->3618 3605 4057e7 3606 404610 SendMessageW 3605->3606 3608 4057f9 OleUninitialize 3606->3608 3607 4057c0 3607->3605 3621 401389 3607->3621 3608->3414 3610->3591 3612 4066a5 17 API calls 3611->3612 3613 4040b4 SetWindowTextW 3612->3613 3613->3594 3615 4064e4 3614->3615 3616 4064e8 3615->3616 3617 4064ed RegOpenKeyExW 3615->3617 3616->3600 3616->3601 3617->3616 3619 404628 3618->3619 3620 404619 SendMessageW 3618->3620 3619->3607 3620->3619 3623 401390 3621->3623 3622 4013fe 3622->3607 3623->3622 3624 4013cb MulDiv SendMessageW 3623->3624 3624->3623 3625->3429 3627 405fff 3626->3627 3629 406011 3626->3629 3628 40600c CharNextW 3627->3628 3627->3629 3631 406035 3628->3631 3630 405f64 CharNextW 3629->3630 3629->3631 3630->3629 3631->3432 3631->3433 3633 4069b4 FindClose 3632->3633 3634 4069bf 3632->3634 3633->3634 3634->3439 3635->3460 3636->3460 3637->3458 3639 406304 GetShortPathNameW 3638->3639 3640 4062de 3638->3640 3641 406423 3639->3641 3642 406319 3639->3642 3665 406158 GetFileAttributesW CreateFileW 3640->3665 3641->3474 3642->3641 3644 406321 wsprintfA 3642->3644 3646 4066a5 17 API calls 3644->3646 3645 4062e8 CloseHandle GetShortPathNameW 3645->3641 3647 4062fc 3645->3647 3648 406349 3646->3648 3647->3639 3647->3641 3666 406158 GetFileAttributesW CreateFileW 3648->3666 3650 406356 3650->3641 3651 406365 GetFileSize GlobalAlloc 3650->3651 3652 406387 3651->3652 3653 40641c CloseHandle 3651->3653 3654 4061db ReadFile 3652->3654 3653->3641 3655 40638f 3654->3655 3655->3653 3667 4060bd lstrlenA 3655->3667 3658 4063a6 lstrcpyA 3661 4063c8 3658->3661 3659 4063ba 3660 4060bd 4 API calls 3659->3660 3660->3661 3662 4063ff SetFilePointer 3661->3662 3663 40620a WriteFile 3662->3663 3664 406415 GlobalFree 3663->3664 3664->3653 3665->3645 3666->3650 3668 4060fe lstrlenA 3667->3668 3669 406106 3668->3669 3670 4060d7 lstrcmpiA 3668->3670 3669->3658 3669->3659 3670->3669 3671 4060f5 CharNextA 3670->3671 3671->3668 3672 401941 3673 401943 3672->3673 3678 402da6 3673->3678 3679 402db2 3678->3679 3680 4066a5 17 API calls 3679->3680 3681 402dd3 3680->3681 3682 401948 3681->3682 3683 4068ef 5 API calls 3681->3683 3684 405d74 3682->3684 3683->3682 3685 40603f 18 API calls 3684->3685 3686 405d94 3685->3686 3687 405d9c DeleteFileW 3686->3687 3688 405db3 3686->3688 3692 401951 3687->3692 3689 405ed3 3688->3689 3720 406668 lstrcpynW 3688->3720 3689->3692 3696 40699e 2 API calls 3689->3696 3691 405dd9 3693 405dec 3691->3693 3694 405ddf lstrcatW 3691->3694 3695 405f83 2 API calls 3693->3695 3697 405df2 3694->3697 3695->3697 3699 405ef8 3696->3699 3698 405e02 lstrcatW 3697->3698 3700 405e0d lstrlenW FindFirstFileW 3697->3700 3698->3700 3699->3692 3701 405f37 3 API calls 3699->3701 3700->3689 3718 405e2f 3700->3718 3702 405f02 3701->3702 3704 405d2c 5 API calls 3702->3704 3703 405eb6 FindNextFileW 3707 405ecc FindClose 3703->3707 3703->3718 3706 405f0e 3704->3706 3708 405f12 3706->3708 3709 405f28 3706->3709 3707->3689 3708->3692 3712 4056ca 24 API calls 3708->3712 3711 4056ca 24 API calls 3709->3711 3711->3692 3714 405f1f 3712->3714 3713 405d74 60 API calls 3713->3718 3716 406428 36 API calls 3714->3716 3715 4056ca 24 API calls 3715->3703 3716->3692 3717 4056ca 24 API calls 3717->3718 3718->3703 3718->3713 3718->3715 3718->3717 3719 406428 36 API calls 3718->3719 3721 406668 lstrcpynW 3718->3721 3722 405d2c 3718->3722 3719->3718 3720->3691 3721->3718 3730 406133 GetFileAttributesW 3722->3730 3725 405d47 RemoveDirectoryW 3728 405d55 3725->3728 3726 405d4f DeleteFileW 3726->3728 3727 405d59 3727->3718 3728->3727 3729 405d65 SetFileAttributesW 3728->3729 3729->3727 3731 405d38 3730->3731 3732 406145 SetFileAttributesW 3730->3732 3731->3725 3731->3726 3731->3727 3732->3731 3733 4015c1 3734 402da6 17 API calls 3733->3734 3735 4015c8 3734->3735 3736 405fe2 4 API calls 3735->3736 3748 4015d1 3736->3748 3737 401631 3738 401663 3737->3738 3739 401636 3737->3739 3743 401423 24 API calls 3738->3743 3752 401423 3739->3752 3740 405f64 CharNextW 3740->3748 3749 40165b 3743->3749 3745 405c16 2 API calls 3745->3748 3746 405c33 5 API calls 3746->3748 3747 40164a SetCurrentDirectoryW 3747->3749 3748->3737 3748->3740 3748->3745 3748->3746 3750 401617 GetFileAttributesW 3748->3750 3751 405b99 4 API calls 3748->3751 3750->3748 3751->3748 3753 4056ca 24 API calls 3752->3753 3754 401431 3753->3754 3755 406668 lstrcpynW 3754->3755 3755->3747 3992 401c43 3993 402d84 17 API calls 3992->3993 3994 401c4a 3993->3994 3995 402d84 17 API calls 3994->3995 3996 401c57 3995->3996 3997 402da6 17 API calls 3996->3997 3998 401c6c 3996->3998 3997->3998 3999 401c7c 3998->3999 4000 402da6 17 API calls 3998->4000 4001 401cd3 3999->4001 4002 401c87 3999->4002 4000->3999 4004 402da6 17 API calls 4001->4004 4003 402d84 17 API calls 4002->4003 4006 401c8c 4003->4006 4005 401cd8 4004->4005 4007 402da6 17 API calls 4005->4007 4008 402d84 17 API calls 4006->4008 4009 401ce1 FindWindowExW 4007->4009 4010 401c98 4008->4010 4013 401d03 4009->4013 4011 401cc3 SendMessageW 4010->4011 4012 401ca5 SendMessageTimeoutW 4010->4012 4011->4013 4012->4013 4021 4028c4 4022 4028ca 4021->4022 4023 4028d2 FindClose 4022->4023 4024 402c2a 4022->4024 4023->4024 4025 4040c5 4026 4040dd 4025->4026 4027 40423e 4025->4027 4026->4027 4028 4040e9 4026->4028 4029 40424f GetDlgItem GetDlgItem 4027->4029 4034 40428f 4027->4034 4031 4040f4 SetWindowPos 4028->4031 4032 404107 4028->4032 4113 4045c4 4029->4113 4030 4042e9 4035 404610 SendMessageW 4030->4035 4043 404239 4030->4043 4031->4032 4036 404110 ShowWindow 4032->4036 4037 404152 4032->4037 4034->4030 4042 401389 2 API calls 4034->4042 4065 4042fb 4035->4065 4044 404130 GetWindowLongW 4036->4044 4045 4041fc 4036->4045 4039 404171 4037->4039 4040 40415a DestroyWindow 4037->4040 4038 404279 SetClassLongW 4041 40140b 2 API calls 4038->4041 4047 404176 SetWindowLongW 4039->4047 4048 404187 4039->4048 4046 40454d 4040->4046 4041->4034 4049 4042c1 4042->4049 4044->4045 4051 404149 ShowWindow 4044->4051 4099 40462b 4045->4099 4046->4043 4058 40457e ShowWindow 4046->4058 4047->4043 4048->4045 4052 404193 GetDlgItem 4048->4052 4049->4030 4053 4042c5 SendMessageW 4049->4053 4051->4037 4056 4041c1 4052->4056 4057 4041a4 SendMessageW IsWindowEnabled 4052->4057 4053->4043 4054 40140b 2 API calls 4054->4065 4055 40454f DestroyWindow EndDialog 4055->4046 4060 4041ce 4056->4060 4063 404215 SendMessageW 4056->4063 4064 4041e1 4056->4064 4070 4041c6 4056->4070 4057->4043 4057->4056 4058->4043 4059 4066a5 17 API calls 4059->4065 4060->4063 4060->4070 4062 4045c4 18 API calls 4062->4065 4063->4045 4066 4041e9 4064->4066 4067 4041fe 4064->4067 4065->4043 4065->4054 4065->4055 4065->4059 4065->4062 4071 4045c4 18 API calls 4065->4071 4087 40448f DestroyWindow 4065->4087 4069 40140b 2 API calls 4066->4069 4068 40140b 2 API calls 4067->4068 4068->4070 4069->4070 4070->4045 4096 40459d 4070->4096 4072 404376 GetDlgItem 4071->4072 4073 404393 ShowWindow EnableWindow 4072->4073 4074 40438b 4072->4074 4116 4045e6 EnableWindow 4073->4116 4074->4073 4076 4043bd EnableWindow 4081 4043d1 4076->4081 4077 4043d6 GetSystemMenu EnableMenuItem SendMessageW 4078 404406 SendMessageW 4077->4078 4077->4081 4078->4081 4080 4040a6 18 API calls 4080->4081 4081->4077 4081->4080 4117 4045f9 SendMessageW 4081->4117 4118 406668 lstrcpynW 4081->4118 4083 404435 lstrlenW 4084 4066a5 17 API calls 4083->4084 4085 40444b SetWindowTextW 4084->4085 4086 401389 2 API calls 4085->4086 4086->4065 4087->4046 4088 4044a9 CreateDialogParamW 4087->4088 4088->4046 4089 4044dc 4088->4089 4090 4045c4 18 API calls 4089->4090 4091 4044e7 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4090->4091 4092 401389 2 API calls 4091->4092 4093 40452d 4092->4093 4093->4043 4094 404535 ShowWindow 4093->4094 4095 404610 SendMessageW 4094->4095 4095->4046 4097 4045a4 4096->4097 4098 4045aa SendMessageW 4096->4098 4097->4098 4098->4045 4100 4046ee 4099->4100 4101 404643 GetWindowLongW 4099->4101 4100->4043 4101->4100 4102 404658 4101->4102 4102->4100 4103 404685 GetSysColor 4102->4103 4104 404688 4102->4104 4103->4104 4105 404698 SetBkMode 4104->4105 4106 40468e SetTextColor 4104->4106 4107 4046b0 GetSysColor 4105->4107 4108 4046b6 4105->4108 4106->4105 4107->4108 4109 4046c7 4108->4109 4110 4046bd SetBkColor 4108->4110 4109->4100 4111 4046e1 CreateBrushIndirect 4109->4111 4112 4046da DeleteObject 4109->4112 4110->4109 4111->4100 4112->4111 4114 4066a5 17 API calls 4113->4114 4115 4045cf SetDlgItemTextW 4114->4115 4115->4038 4116->4076 4117->4081 4118->4083 4122 4016cc 4123 402da6 17 API calls 4122->4123 4124 4016d2 GetFullPathNameW 4123->4124 4125 4016ec 4124->4125 4131 40170e 4124->4131 4127 40699e 2 API calls 4125->4127 4125->4131 4126 401723 GetShortPathNameW 4128 402c2a 4126->4128 4129 4016fe 4127->4129 4129->4131 4132 406668 lstrcpynW 4129->4132 4131->4126 4131->4128 4132->4131 4133 401e4e GetDC 4134 402d84 17 API calls 4133->4134 4135 401e60 GetDeviceCaps MulDiv ReleaseDC 4134->4135 4136 402d84 17 API calls 4135->4136 4137 401e91 4136->4137 4138 4066a5 17 API calls 4137->4138 4139 401ece CreateFontIndirectW 4138->4139 4140 402638 4139->4140 4140->4140 3896 402950 3897 402da6 17 API calls 3896->3897 3899 40295c 3897->3899 3898 402972 3901 406133 2 API calls 3898->3901 3899->3898 3900 402da6 17 API calls 3899->3900 3900->3898 3902 402978 3901->3902 3924 406158 GetFileAttributesW CreateFileW 3902->3924 3904 402985 3905 402a3b 3904->3905 3906 4029a0 GlobalAlloc 3904->3906 3907 402a23 3904->3907 3908 402a42 DeleteFileW 3905->3908 3909 402a55 3905->3909 3906->3907 3910 4029b9 3906->3910 3911 403371 44 API calls 3907->3911 3908->3909 3925 4035f8 SetFilePointer 3910->3925 3913 402a30 CloseHandle 3911->3913 3913->3905 3914 4029bf 3915 4035e2 ReadFile 3914->3915 3916 4029c8 GlobalAlloc 3915->3916 3917 4029d8 3916->3917 3918 402a0c 3916->3918 3919 403371 44 API calls 3917->3919 3920 40620a WriteFile 3918->3920 3923 4029e5 3919->3923 3921 402a18 GlobalFree 3920->3921 3921->3907 3922 402a03 GlobalFree 3922->3918 3923->3922 3924->3904 3925->3914 4148 403cd5 4149 403ce0 4148->4149 4150 403ce4 4149->4150 4151 403ce7 GlobalAlloc 4149->4151 4151->4150 4152 401956 4153 402da6 17 API calls 4152->4153 4154 40195d lstrlenW 4153->4154 4155 402638 4154->4155 4156 4014d7 4157 402d84 17 API calls 4156->4157 4158 4014dd Sleep 4157->4158 4160 402c2a 4158->4160 3926 4020d8 3927 4020ea 3926->3927 3937 40219c 3926->3937 3928 402da6 17 API calls 3927->3928 3929 4020f1 3928->3929 3931 402da6 17 API calls 3929->3931 3930 401423 24 API calls 3933 4022f6 3930->3933 3932 4020fa 3931->3932 3934 402110 LoadLibraryExW 3932->3934 3935 402102 GetModuleHandleW 3932->3935 3936 402121 3934->3936 3934->3937 3935->3934 3935->3936 3946 406aa4 3936->3946 3937->3930 3940 402132 3943 401423 24 API calls 3940->3943 3944 402142 3940->3944 3941 40216b 3942 4056ca 24 API calls 3941->3942 3942->3944 3943->3944 3944->3933 3945 40218e FreeLibrary 3944->3945 3945->3933 3951 40668a WideCharToMultiByte 3946->3951 3948 406ac1 3949 406ac8 GetProcAddress 3948->3949 3950 40212c 3948->3950 3949->3950 3950->3940 3950->3941 3951->3948 4161 402b59 4162 402b60 4161->4162 4163 402bab 4161->4163 4165 402ba9 4162->4165 4167 402d84 17 API calls 4162->4167 4164 406a35 5 API calls 4163->4164 4166 402bb2 4164->4166 4168 402da6 17 API calls 4166->4168 4169 402b6e 4167->4169 4170 402bbb 4168->4170 4171 402d84 17 API calls 4169->4171 4170->4165 4172 402bbf IIDFromString 4170->4172 4174 402b7a 4171->4174 4172->4165 4173 402bce 4172->4173 4173->4165 4179 406668 lstrcpynW 4173->4179 4178 4065af wsprintfW 4174->4178 4177 402beb CoTaskMemFree 4177->4165 4178->4165 4179->4177 4180 402a5b 4181 402d84 17 API calls 4180->4181 4182 402a61 4181->4182 4183 402aa4 4182->4183 4184 402a88 4182->4184 4189 40292e 4182->4189 4186 402abe 4183->4186 4187 402aae 4183->4187 4185 402a8d 4184->4185 4193 402a9e 4184->4193 4194 406668 lstrcpynW 4185->4194 4188 4066a5 17 API calls 4186->4188 4190 402d84 17 API calls 4187->4190 4188->4193 4190->4193 4193->4189 4195 4065af wsprintfW 4193->4195 4194->4189 4195->4189 3975 40175c 3976 402da6 17 API calls 3975->3976 3977 401763 3976->3977 3978 406187 2 API calls 3977->3978 3979 40176a 3978->3979 3980 406187 2 API calls 3979->3980 3980->3979 4196 401d5d 4197 402d84 17 API calls 4196->4197 4198 401d6e SetWindowLongW 4197->4198 4199 402c2a 4198->4199 4200 4028de 4201 4028e6 4200->4201 4202 4028ea FindNextFileW 4201->4202 4204 4028fc 4201->4204 4203 402943 4202->4203 4202->4204 4206 406668 lstrcpynW 4203->4206 4206->4204 4207 406d5f 4213 406be3 4207->4213 4208 40754e 4209 406c64 GlobalFree 4210 406c6d GlobalAlloc 4209->4210 4210->4208 4210->4213 4211 406ce4 GlobalAlloc 4211->4208 4211->4213 4212 406cdb GlobalFree 4212->4211 4213->4208 4213->4209 4213->4210 4213->4211 4213->4212 4214 401563 4215 402ba4 4214->4215 4218 4065af wsprintfW 4215->4218 4217 402ba9 4218->4217 4219 401968 4220 402d84 17 API calls 4219->4220 4221 40196f 4220->4221 4222 402d84 17 API calls 4221->4222 4223 40197c 4222->4223 4224 402da6 17 API calls 4223->4224 4225 401993 lstrlenW 4224->4225 4227 4019a4 4225->4227 4226 4019e5 4227->4226 4231 406668 lstrcpynW 4227->4231 4229 4019d5 4229->4226 4230 4019da lstrlenW 4229->4230 4230->4226 4231->4229 4239 40166a 4240 402da6 17 API calls 4239->4240 4241 401670 4240->4241 4242 40699e 2 API calls 4241->4242 4243 401676 4242->4243 4244 402aeb 4245 402d84 17 API calls 4244->4245 4246 402af1 4245->4246 4247 4066a5 17 API calls 4246->4247 4248 40292e 4246->4248 4247->4248 4249 4026ec 4250 402d84 17 API calls 4249->4250 4251 4026fb 4250->4251 4252 402745 ReadFile 4251->4252 4253 4061db ReadFile 4251->4253 4255 402785 MultiByteToWideChar 4251->4255 4256 40283a 4251->4256 4258 4027ab SetFilePointer MultiByteToWideChar 4251->4258 4259 40284b 4251->4259 4261 402838 4251->4261 4262 406239 SetFilePointer 4251->4262 4252->4251 4252->4261 4253->4251 4255->4251 4271 4065af wsprintfW 4256->4271 4258->4251 4260 40286c SetFilePointer 4259->4260 4259->4261 4260->4261 4263 406255 4262->4263 4266 40626d 4262->4266 4264 4061db ReadFile 4263->4264 4265 406261 4264->4265 4265->4266 4267 406276 SetFilePointer 4265->4267 4268 40629e SetFilePointer 4265->4268 4266->4251 4267->4268 4269 406281 4267->4269 4268->4266 4270 40620a WriteFile 4269->4270 4270->4266 4271->4261 4272 404a6e 4273 404aa4 4272->4273 4274 404a7e 4272->4274 4276 40462b 8 API calls 4273->4276 4275 4045c4 18 API calls 4274->4275 4277 404a8b SetDlgItemTextW 4275->4277 4278 404ab0 4276->4278 4277->4273 3855 40176f 3856 402da6 17 API calls 3855->3856 3857 401776 3856->3857 3858 401796 3857->3858 3859 40179e 3857->3859 3894 406668 lstrcpynW 3858->3894 3895 406668 lstrcpynW 3859->3895 3862 40179c 3866 4068ef 5 API calls 3862->3866 3863 4017a9 3864 405f37 3 API calls 3863->3864 3865 4017af lstrcatW 3864->3865 3865->3862 3886 4017bb 3866->3886 3867 40699e 2 API calls 3867->3886 3868 406133 2 API calls 3868->3886 3870 4017cd CompareFileTime 3870->3886 3871 40188d 3873 4056ca 24 API calls 3871->3873 3872 401864 3874 4056ca 24 API calls 3872->3874 3882 401879 3872->3882 3875 401897 3873->3875 3874->3882 3876 403371 44 API calls 3875->3876 3877 4018aa 3876->3877 3878 4018be SetFileTime 3877->3878 3879 4018d0 CloseHandle 3877->3879 3878->3879 3881 4018e1 3879->3881 3879->3882 3880 4066a5 17 API calls 3880->3886 3884 4018e6 3881->3884 3885 4018f9 3881->3885 3883 406668 lstrcpynW 3883->3886 3887 4066a5 17 API calls 3884->3887 3888 4066a5 17 API calls 3885->3888 3886->3867 3886->3868 3886->3870 3886->3871 3886->3872 3886->3880 3886->3883 3889 405cc8 MessageBoxIndirectW 3886->3889 3893 406158 GetFileAttributesW CreateFileW 3886->3893 3890 4018ee lstrcatW 3887->3890 3891 401901 3888->3891 3889->3886 3890->3891 3892 405cc8 MessageBoxIndirectW 3891->3892 3892->3882 3893->3886 3894->3862 3895->3863 4279 401a72 4280 402d84 17 API calls 4279->4280 4281 401a7b 4280->4281 4282 402d84 17 API calls 4281->4282 4283 401a20 4282->4283 4284 401573 4285 401583 ShowWindow 4284->4285 4286 40158c 4284->4286 4285->4286 4287 402c2a 4286->4287 4288 40159a ShowWindow 4286->4288 4288->4287 4289 4023f4 4290 402da6 17 API calls 4289->4290 4291 402403 4290->4291 4292 402da6 17 API calls 4291->4292 4293 40240c 4292->4293 4294 402da6 17 API calls 4293->4294 4295 402416 GetPrivateProfileStringW 4294->4295 4296 4014f5 SetForegroundWindow 4297 402c2a 4296->4297 4298 401ff6 4299 402da6 17 API calls 4298->4299 4300 401ffd 4299->4300 4301 40699e 2 API calls 4300->4301 4302 402003 4301->4302 4304 402014 4302->4304 4305 4065af wsprintfW 4302->4305 4305->4304 4306 401b77 4307 402da6 17 API calls 4306->4307 4308 401b7e 4307->4308 4309 402d84 17 API calls 4308->4309 4310 401b87 wsprintfW 4309->4310 4311 402c2a 4310->4311 4312 4046fa lstrcpynW lstrlenW 4313 40167b 4314 402da6 17 API calls 4313->4314 4315 401682 4314->4315 4316 402da6 17 API calls 4315->4316 4317 40168b 4316->4317 4318 402da6 17 API calls 4317->4318 4319 401694 MoveFileW 4318->4319 4320 4016a0 4319->4320 4321 4016a7 4319->4321 4323 401423 24 API calls 4320->4323 4322 40699e 2 API calls 4321->4322 4325 4022f6 4321->4325 4324 4016b6 4322->4324 4323->4325 4324->4325 4326 406428 36 API calls 4324->4326 4326->4320 4334 4019ff 4335 402da6 17 API calls 4334->4335 4336 401a06 4335->4336 4337 402da6 17 API calls 4336->4337 4338 401a0f 4337->4338 4339 401a16 lstrcmpiW 4338->4339 4340 401a28 lstrcmpW 4338->4340 4341 401a1c 4339->4341 4340->4341 4342 4022ff 4343 402da6 17 API calls 4342->4343 4344 402305 4343->4344 4345 402da6 17 API calls 4344->4345 4346 40230e 4345->4346 4347 402da6 17 API calls 4346->4347 4348 402317 4347->4348 4349 40699e 2 API calls 4348->4349 4350 402320 4349->4350 4351 402331 lstrlenW lstrlenW 4350->4351 4352 402324 4350->4352 4354 4056ca 24 API calls 4351->4354 4353 4056ca 24 API calls 4352->4353 4356 40232c 4352->4356 4353->4356 4355 40236f SHFileOperationW 4354->4355 4355->4352 4355->4356 4357 401000 4358 401037 BeginPaint GetClientRect 4357->4358 4359 40100c DefWindowProcW 4357->4359 4361 4010f3 4358->4361 4362 401179 4359->4362 4363 401073 CreateBrushIndirect FillRect DeleteObject 4361->4363 4364 4010fc 4361->4364 4363->4361 4365 401102 CreateFontIndirectW 4364->4365 4366 401167 EndPaint 4364->4366 4365->4366 4367 401112 6 API calls 4365->4367 4366->4362 4367->4366 4368 401d81 4369 401d94 GetDlgItem 4368->4369 4370 401d87 4368->4370 4372 401d8e 4369->4372 4371 402d84 17 API calls 4370->4371 4371->4372 4373 401dd5 GetClientRect LoadImageW SendMessageW 4372->4373 4375 402da6 17 API calls 4372->4375 4376 401e33 4373->4376 4378 401e3f 4373->4378 4375->4373 4377 401e38 DeleteObject 4376->4377 4376->4378 4377->4378 4379 401503 4380 40150b 4379->4380 4382 40151e 4379->4382 4381 402d84 17 API calls 4380->4381 4381->4382 4383 404783 4384 40479b 4383->4384 4388 4048b5 4383->4388 4389 4045c4 18 API calls 4384->4389 4385 40491f 4386 4049e9 4385->4386 4387 404929 GetDlgItem 4385->4387 4394 40462b 8 API calls 4386->4394 4390 404943 4387->4390 4391 4049aa 4387->4391 4388->4385 4388->4386 4392 4048f0 GetDlgItem SendMessageW 4388->4392 4393 404802 4389->4393 4390->4391 4399 404969 SendMessageW LoadCursorW SetCursor 4390->4399 4391->4386 4395 4049bc 4391->4395 4416 4045e6 EnableWindow 4392->4416 4397 4045c4 18 API calls 4393->4397 4398 4049e4 4394->4398 4400 4049d2 4395->4400 4401 4049c2 SendMessageW 4395->4401 4403 40480f CheckDlgButton 4397->4403 4420 404a32 4399->4420 4400->4398 4406 4049d8 SendMessageW 4400->4406 4401->4400 4402 40491a 4417 404a0e 4402->4417 4414 4045e6 EnableWindow 4403->4414 4406->4398 4409 40482d GetDlgItem 4415 4045f9 SendMessageW 4409->4415 4411 404843 SendMessageW 4412 404860 GetSysColor 4411->4412 4413 404869 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4411->4413 4412->4413 4413->4398 4414->4409 4415->4411 4416->4402 4418 404a21 SendMessageW 4417->4418 4419 404a1c 4417->4419 4418->4385 4419->4418 4423 405c8e ShellExecuteExW 4420->4423 4422 404998 LoadCursorW SetCursor 4422->4391 4423->4422 4424 402383 4425 40238a 4424->4425 4428 40239d 4424->4428 4426 4066a5 17 API calls 4425->4426 4427 402397 4426->4427 4429 405cc8 MessageBoxIndirectW 4427->4429 4429->4428 4430 402c05 SendMessageW 4431 402c2a 4430->4431 4432 402c1f InvalidateRect 4430->4432 4432->4431 3790 401389 3792 401390 3790->3792 3791 4013fe 3792->3791 3793 4013cb MulDiv SendMessageW 3792->3793 3793->3792 4433 405809 4434 4059b3 4433->4434 4435 40582a GetDlgItem GetDlgItem GetDlgItem 4433->4435 4437 4059e4 4434->4437 4438 4059bc GetDlgItem CreateThread CloseHandle 4434->4438 4478 4045f9 SendMessageW 4435->4478 4440 405a0f 4437->4440 4441 405a34 4437->4441 4442 4059fb ShowWindow ShowWindow 4437->4442 4438->4437 4439 40589a 4444 4058a1 GetClientRect GetSystemMetrics SendMessageW SendMessageW 4439->4444 4443 405a6f 4440->4443 4446 405a23 4440->4446 4447 405a49 ShowWindow 4440->4447 4448 40462b 8 API calls 4441->4448 4480 4045f9 SendMessageW 4442->4480 4443->4441 4453 405a7d SendMessageW 4443->4453 4451 4058f3 SendMessageW SendMessageW 4444->4451 4452 40590f 4444->4452 4454 40459d SendMessageW 4446->4454 4449 405a69 4447->4449 4450 405a5b 4447->4450 4459 405a42 4448->4459 4456 40459d SendMessageW 4449->4456 4455 4056ca 24 API calls 4450->4455 4451->4452 4457 405922 4452->4457 4458 405914 SendMessageW 4452->4458 4453->4459 4460 405a96 CreatePopupMenu 4453->4460 4454->4441 4455->4449 4456->4443 4462 4045c4 18 API calls 4457->4462 4458->4457 4461 4066a5 17 API calls 4460->4461 4463 405aa6 AppendMenuW 4461->4463 4464 405932 4462->4464 4465 405ac3 GetWindowRect 4463->4465 4466 405ad6 TrackPopupMenu 4463->4466 4467 40593b ShowWindow 4464->4467 4468 40596f GetDlgItem SendMessageW 4464->4468 4465->4466 4466->4459 4470 405af1 4466->4470 4471 405951 ShowWindow 4467->4471 4472 40595e 4467->4472 4468->4459 4469 405996 SendMessageW SendMessageW 4468->4469 4469->4459 4473 405b0d SendMessageW 4470->4473 4471->4472 4479 4045f9 SendMessageW 4472->4479 4473->4473 4474 405b2a OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4473->4474 4476 405b4f SendMessageW 4474->4476 4476->4476 4477 405b78 GlobalUnlock SetClipboardData CloseClipboard 4476->4477 4477->4459 4478->4439 4479->4468 4480->4440 3794 40248a 3795 402da6 17 API calls 3794->3795 3796 40249c 3795->3796 3797 402da6 17 API calls 3796->3797 3798 4024a6 3797->3798 3811 402e36 3798->3811 3801 40292e 3802 4024de 3804 4024ea 3802->3804 3815 402d84 3802->3815 3803 402da6 17 API calls 3805 4024d4 lstrlenW 3803->3805 3807 402509 RegSetValueExW 3804->3807 3808 403371 44 API calls 3804->3808 3805->3802 3809 40251f RegCloseKey 3807->3809 3808->3807 3809->3801 3812 402e51 3811->3812 3818 406503 3812->3818 3816 4066a5 17 API calls 3815->3816 3817 402d99 3816->3817 3817->3804 3819 406512 3818->3819 3820 4024b6 3819->3820 3821 40651d RegCreateKeyExW 3819->3821 3820->3801 3820->3802 3820->3803 3821->3820 4481 404e0b 4482 404e37 4481->4482 4483 404e1b 4481->4483 4485 404e6a 4482->4485 4486 404e3d SHGetPathFromIDListW 4482->4486 4492 405cac GetDlgItemTextW 4483->4492 4487 404e54 SendMessageW 4486->4487 4488 404e4d 4486->4488 4487->4485 4490 40140b 2 API calls 4488->4490 4489 404e28 SendMessageW 4489->4482 4490->4487 4492->4489 4493 40290b 4494 402da6 17 API calls 4493->4494 4495 402912 FindFirstFileW 4494->4495 4496 40293a 4495->4496 4500 402925 4495->4500 4501 4065af wsprintfW 4496->4501 4498 402943 4502 406668 lstrcpynW 4498->4502 4501->4498 4502->4500 4503 40190c 4504 401943 4503->4504 4505 402da6 17 API calls 4504->4505 4506 401948 4505->4506 4507 405d74 67 API calls 4506->4507 4508 401951 4507->4508 4509 40190f 4510 402da6 17 API calls 4509->4510 4511 401916 4510->4511 4512 405cc8 MessageBoxIndirectW 4511->4512 4513 40191f 4512->4513 4514 401491 4515 4056ca 24 API calls 4514->4515 4516 401498 4515->4516 4517 402891 4518 402898 4517->4518 4519 402ba9 4517->4519 4520 402d84 17 API calls 4518->4520 4521 40289f 4520->4521 4522 4028ae SetFilePointer 4521->4522 4522->4519 4523 4028be 4522->4523 4525 4065af wsprintfW 4523->4525 4525->4519 4526 401f12 4527 402da6 17 API calls 4526->4527 4528 401f18 4527->4528 4529 402da6 17 API calls 4528->4529 4530 401f21 4529->4530 4531 402da6 17 API calls 4530->4531 4532 401f2a 4531->4532 4533 402da6 17 API calls 4532->4533 4534 401f33 4533->4534 4535 401423 24 API calls 4534->4535 4536 401f3a 4535->4536 4543 405c8e ShellExecuteExW 4536->4543 4538 401f82 4539 406ae0 5 API calls 4538->4539 4541 40292e 4538->4541 4540 401f9f CloseHandle 4539->4540 4540->4541 4543->4538 4544 402f93 4545 402fa5 SetTimer 4544->4545 4546 402fbe 4544->4546 4545->4546 4547 40300c 4546->4547 4548 403012 MulDiv 4546->4548 4549 402fcc wsprintfW SetWindowTextW SetDlgItemTextW 4548->4549 4549->4547 4565 401d17 4566 402d84 17 API calls 4565->4566 4567 401d1d IsWindow 4566->4567 4568 401a20 4567->4568 3952 401b9b 3953 401ba8 3952->3953 3954 401bec 3952->3954 3961 401bbf 3953->3961 3963 401c31 3953->3963 3955 401bf1 3954->3955 3956 401c16 GlobalAlloc 3954->3956 3960 40239d 3955->3960 3971 406668 lstrcpynW 3955->3971 3958 4066a5 17 API calls 3956->3958 3957 4066a5 17 API calls 3959 402397 3957->3959 3958->3963 3967 405cc8 MessageBoxIndirectW 3959->3967 3972 406668 lstrcpynW 3961->3972 3963->3957 3963->3960 3965 401c03 GlobalFree 3965->3960 3966 401bce 3973 406668 lstrcpynW 3966->3973 3967->3960 3969 401bdd 3974 406668 lstrcpynW 3969->3974 3971->3965 3972->3966 3973->3969 3974->3960 4569 40261c 4570 402da6 17 API calls 4569->4570 4571 402623 4570->4571 4574 406158 GetFileAttributesW CreateFileW 4571->4574 4573 40262f 4574->4573 3981 40259e 3982 402de6 17 API calls 3981->3982 3983 4025a8 3982->3983 3984 402d84 17 API calls 3983->3984 3985 4025b1 3984->3985 3986 40292e 3985->3986 3987 4025d9 RegEnumValueW 3985->3987 3988 4025cd RegEnumKeyW 3985->3988 3989 4025ee 3987->3989 3990 4025f5 RegCloseKey 3987->3990 3988->3990 3989->3990 3990->3986 4582 40149e 4583 4014ac PostQuitMessage 4582->4583 4584 40239d 4582->4584 4583->4584 4585 4015a3 4586 402da6 17 API calls 4585->4586 4587 4015aa SetFileAttributesW 4586->4587 4588 4015bc 4587->4588 3756 401fa4 3757 402da6 17 API calls 3756->3757 3758 401faa 3757->3758 3759 4056ca 24 API calls 3758->3759 3760 401fb4 3759->3760 3761 405c4b 2 API calls 3760->3761 3762 401fba 3761->3762 3763 401fdd CloseHandle 3762->3763 3767 40292e 3762->3767 3771 406ae0 WaitForSingleObject 3762->3771 3763->3767 3766 401fcf 3768 401fd4 3766->3768 3769 401fdf 3766->3769 3776 4065af wsprintfW 3768->3776 3769->3763 3772 406afa 3771->3772 3773 406b0c GetExitCodeProcess 3772->3773 3774 406a71 2 API calls 3772->3774 3773->3766 3775 406b01 WaitForSingleObject 3774->3775 3775->3772 3776->3763 3777 403c25 3778 403c40 3777->3778 3779 403c36 CloseHandle 3777->3779 3780 403c54 3778->3780 3781 403c4a CloseHandle 3778->3781 3779->3778 3786 403c82 3780->3786 3781->3780 3784 405d74 67 API calls 3785 403c65 3784->3785 3787 403c90 3786->3787 3788 403c59 3787->3788 3789 403c95 FreeLibrary GlobalFree 3787->3789 3788->3784 3789->3788 3789->3789 3822 40252a 3833 402de6 3822->3833 3825 402da6 17 API calls 3826 40253d 3825->3826 3827 402548 RegQueryValueExW 3826->3827 3831 40292e 3826->3831 3828 40256e RegCloseKey 3827->3828 3829 402568 3827->3829 3828->3831 3829->3828 3838 4065af wsprintfW 3829->3838 3834 402da6 17 API calls 3833->3834 3835 402dfd 3834->3835 3836 4064d5 RegOpenKeyExW 3835->3836 3837 402534 3836->3837 3837->3825 3838->3828 3839 4021aa 3840 402da6 17 API calls 3839->3840 3841 4021b1 3840->3841 3842 402da6 17 API calls 3841->3842 3843 4021bb 3842->3843 3844 402da6 17 API calls 3843->3844 3845 4021c5 3844->3845 3846 402da6 17 API calls 3845->3846 3847 4021cf 3846->3847 3848 402da6 17 API calls 3847->3848 3849 4021d9 3848->3849 3850 402218 CoCreateInstance 3849->3850 3851 402da6 17 API calls 3849->3851 3854 402237 3850->3854 3851->3850 3852 401423 24 API calls 3853 4022f6 3852->3853 3854->3852 3854->3853 4589 40202a 4590 402da6 17 API calls 4589->4590 4591 402031 4590->4591 4592 406a35 5 API calls 4591->4592 4593 402040 4592->4593 4594 4020cc 4593->4594 4595 40205c GlobalAlloc 4593->4595 4595->4594 4596 402070 4595->4596 4597 406a35 5 API calls 4596->4597 4598 402077 4597->4598 4599 406a35 5 API calls 4598->4599 4600 402081 4599->4600 4600->4594 4604 4065af wsprintfW 4600->4604 4602 4020ba 4605 4065af wsprintfW 4602->4605 4604->4602 4605->4594 4613 401a30 4614 402da6 17 API calls 4613->4614 4615 401a39 ExpandEnvironmentStringsW 4614->4615 4616 401a60 4615->4616 4617 401a4d 4615->4617 4617->4616 4618 401a52 lstrcmpW 4617->4618 4618->4616 4619 405031 GetDlgItem GetDlgItem 4620 405083 7 API calls 4619->4620 4621 4052a8 4619->4621 4622 40512a DeleteObject 4620->4622 4623 40511d SendMessageW 4620->4623 4626 40538a 4621->4626 4653 405317 4621->4653 4673 404f7f SendMessageW 4621->4673 4624 405133 4622->4624 4623->4622 4625 40516a 4624->4625 4629 4066a5 17 API calls 4624->4629 4627 4045c4 18 API calls 4625->4627 4628 405436 4626->4628 4632 40529b 4626->4632 4638 4053e3 SendMessageW 4626->4638 4631 40517e 4627->4631 4633 405440 SendMessageW 4628->4633 4634 405448 4628->4634 4630 40514c SendMessageW SendMessageW 4629->4630 4630->4624 4637 4045c4 18 API calls 4631->4637 4635 40462b 8 API calls 4632->4635 4633->4634 4641 405461 4634->4641 4642 40545a ImageList_Destroy 4634->4642 4649 405471 4634->4649 4640 405637 4635->4640 4654 40518f 4637->4654 4638->4632 4644 4053f8 SendMessageW 4638->4644 4639 40537c SendMessageW 4639->4626 4645 40546a GlobalFree 4641->4645 4641->4649 4642->4641 4643 4055eb 4643->4632 4650 4055fd ShowWindow GetDlgItem ShowWindow 4643->4650 4647 40540b 4644->4647 4645->4649 4646 40526a GetWindowLongW SetWindowLongW 4648 405283 4646->4648 4658 40541c SendMessageW 4647->4658 4651 4052a0 4648->4651 4652 405288 ShowWindow 4648->4652 4649->4643 4666 4054ac 4649->4666 4678 404fff 4649->4678 4650->4632 4672 4045f9 SendMessageW 4651->4672 4671 4045f9 SendMessageW 4652->4671 4653->4626 4653->4639 4654->4646 4657 4051e2 SendMessageW 4654->4657 4659 405265 4654->4659 4660 405220 SendMessageW 4654->4660 4661 405234 SendMessageW 4654->4661 4657->4654 4658->4628 4659->4646 4659->4648 4660->4654 4661->4654 4663 4055b6 4664 4055c1 InvalidateRect 4663->4664 4667 4055cd 4663->4667 4664->4667 4665 4054da SendMessageW 4669 4054f0 4665->4669 4666->4665 4666->4669 4667->4643 4687 404f3a 4667->4687 4668 405564 SendMessageW SendMessageW 4668->4669 4669->4663 4669->4668 4671->4632 4672->4621 4674 404fa2 GetMessagePos ScreenToClient SendMessageW 4673->4674 4675 404fde SendMessageW 4673->4675 4676 404fd6 4674->4676 4677 404fdb 4674->4677 4675->4676 4676->4653 4677->4675 4690 406668 lstrcpynW 4678->4690 4680 405012 4691 4065af wsprintfW 4680->4691 4682 40501c 4683 40140b 2 API calls 4682->4683 4684 405025 4683->4684 4692 406668 lstrcpynW 4684->4692 4686 40502c 4686->4666 4693 404e71 4687->4693 4689 404f4f 4689->4643 4690->4680 4691->4682 4692->4686 4694 404e8a 4693->4694 4695 4066a5 17 API calls 4694->4695 4696 404eee 4695->4696 4697 4066a5 17 API calls 4696->4697 4698 404ef9 4697->4698 4699 4066a5 17 API calls 4698->4699 4700 404f0f lstrlenW wsprintfW SetDlgItemTextW 4699->4700 4700->4689 4706 4023b2 4707 4023ba 4706->4707 4710 4023c0 4706->4710 4708 402da6 17 API calls 4707->4708 4708->4710 4709 4023ce 4712 4023dc 4709->4712 4713 402da6 17 API calls 4709->4713 4710->4709 4711 402da6 17 API calls 4710->4711 4711->4709 4714 402da6 17 API calls 4712->4714 4713->4712 4715 4023e5 WritePrivateProfileStringW 4714->4715 4716 404734 lstrlenW 4717 404753 4716->4717 4718 404755 WideCharToMultiByte 4716->4718 4717->4718 4719 402434 4720 402467 4719->4720 4721 40243c 4719->4721 4723 402da6 17 API calls 4720->4723 4722 402de6 17 API calls 4721->4722 4724 402443 4722->4724 4725 40246e 4723->4725 4727 402da6 17 API calls 4724->4727 4729 40247b 4724->4729 4730 402e64 4725->4730 4728 402454 RegDeleteValueW RegCloseKey 4727->4728 4728->4729 4731 402e78 4730->4731 4733 402e71 4730->4733 4731->4733 4734 402ea9 4731->4734 4733->4729 4735 4064d5 RegOpenKeyExW 4734->4735 4736 402ed7 4735->4736 4737 402ee7 RegEnumValueW 4736->4737 4744 402f81 4736->4744 4746 402f0a 4736->4746 4738 402f71 RegCloseKey 4737->4738 4737->4746 4738->4744 4739 402f46 RegEnumKeyW 4740 402f4f RegCloseKey 4739->4740 4739->4746 4741 406a35 5 API calls 4740->4741 4742 402f5f 4741->4742 4742->4744 4745 402f63 RegDeleteKeyW 4742->4745 4743 402ea9 6 API calls 4743->4746 4744->4733 4745->4744 4746->4738 4746->4739 4746->4740 4746->4743 4747 401735 4748 402da6 17 API calls 4747->4748 4749 40173c SearchPathW 4748->4749 4750 401757 4749->4750 4751 404ab5 4752 404ae1 4751->4752 4753 404af2 4751->4753 4812 405cac GetDlgItemTextW 4752->4812 4755 404afe GetDlgItem 4753->4755 4760 404b5d 4753->4760 4758 404b12 4755->4758 4756 404c41 4761 404df0 4756->4761 4814 405cac GetDlgItemTextW 4756->4814 4757 404aec 4759 4068ef 5 API calls 4757->4759 4763 404b26 SetWindowTextW 4758->4763 4764 405fe2 4 API calls 4758->4764 4759->4753 4760->4756 4760->4761 4765 4066a5 17 API calls 4760->4765 4768 40462b 8 API calls 4761->4768 4767 4045c4 18 API calls 4763->4767 4769 404b1c 4764->4769 4770 404bd1 SHBrowseForFolderW 4765->4770 4766 404c71 4771 40603f 18 API calls 4766->4771 4772 404b42 4767->4772 4773 404e04 4768->4773 4769->4763 4777 405f37 3 API calls 4769->4777 4770->4756 4774 404be9 CoTaskMemFree 4770->4774 4775 404c77 4771->4775 4776 4045c4 18 API calls 4772->4776 4778 405f37 3 API calls 4774->4778 4815 406668 lstrcpynW 4775->4815 4779 404b50 4776->4779 4777->4763 4780 404bf6 4778->4780 4813 4045f9 SendMessageW 4779->4813 4783 404c2d SetDlgItemTextW 4780->4783 4788 4066a5 17 API calls 4780->4788 4783->4756 4784 404b56 4786 406a35 5 API calls 4784->4786 4785 404c8e 4787 406a35 5 API calls 4785->4787 4786->4760 4794 404c95 4787->4794 4789 404c15 lstrcmpiW 4788->4789 4789->4783 4792 404c26 lstrcatW 4789->4792 4790 404cd6 4816 406668 lstrcpynW 4790->4816 4792->4783 4793 404cdd 4795 405fe2 4 API calls 4793->4795 4794->4790 4798 405f83 2 API calls 4794->4798 4800 404d2e 4794->4800 4796 404ce3 GetDiskFreeSpaceW 4795->4796 4799 404d07 MulDiv 4796->4799 4796->4800 4798->4794 4799->4800 4802 404f3a 20 API calls 4800->4802 4810 404d9f 4800->4810 4801 404dc2 4817 4045e6 EnableWindow 4801->4817 4804 404d8c 4802->4804 4803 40140b 2 API calls 4803->4801 4806 404da1 SetDlgItemTextW 4804->4806 4807 404d91 4804->4807 4806->4810 4808 404e71 20 API calls 4807->4808 4808->4810 4809 404dde 4809->4761 4811 404a0e SendMessageW 4809->4811 4810->4801 4810->4803 4811->4761 4812->4757 4813->4784 4814->4766 4815->4785 4816->4793 4817->4809 4818 401d38 4819 402d84 17 API calls 4818->4819 4820 401d3f 4819->4820 4821 402d84 17 API calls 4820->4821 4822 401d4b GetDlgItem 4821->4822 4823 402638 4822->4823 4824 4014b8 4825 4014be 4824->4825 4826 401389 2 API calls 4825->4826 4827 4014c6 4826->4827 4828 40563e 4829 405662 4828->4829 4830 40564e 4828->4830 4833 40566a IsWindowVisible 4829->4833 4839 405681 4829->4839 4831 405654 4830->4831 4832 4056ab 4830->4832 4835 404610 SendMessageW 4831->4835 4834 4056b0 CallWindowProcW 4832->4834 4833->4832 4836 405677 4833->4836 4837 40565e 4834->4837 4835->4837 4838 404f7f 5 API calls 4836->4838 4838->4839 4839->4834 4840 404fff 4 API calls 4839->4840 4840->4832 4841 40263e 4842 402652 4841->4842 4843 40266d 4841->4843 4844 402d84 17 API calls 4842->4844 4845 402672 4843->4845 4846 40269d 4843->4846 4855 402659 4844->4855 4848 402da6 17 API calls 4845->4848 4847 402da6 17 API calls 4846->4847 4850 4026a4 lstrlenW 4847->4850 4849 402679 4848->4849 4858 40668a WideCharToMultiByte 4849->4858 4850->4855 4852 40268d lstrlenA 4852->4855 4853 4026e7 4854 4026d1 4854->4853 4856 40620a WriteFile 4854->4856 4855->4853 4855->4854 4857 406239 5 API calls 4855->4857 4856->4853 4857->4854 4858->4852

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00403640 Relevance: 93.2, APIs: 34, Strings: 19, Instructions: 450stringfilecomCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 0 403640-403690 SetErrorMode GetVersionExW 1 403692-4036c6 GetVersionExW 0->1 2 4036ca-4036d1 0->2 1->2 3 4036d3 2->3 4 4036db-40371b 2->4 3->4 5 40371d-403725 call 406a35 4->5 6 40372e 4->6 5->6 11 403727 5->11 8 403733-403747 call 4069c5 lstrlenA 6->8 13 403749-403765 call 406a35 * 3 8->13 11->6 20 403776-4037d8 #17 OleInitialize SHGetFileInfoW call 406668 GetCommandLineW call 406668 13->20 21 403767-40376d 13->21 28 4037e1-4037f4 call 405f64 CharNextW 20->28 29 4037da-4037dc 20->29 21->20 25 40376f 21->25 25->20 32 4038eb-4038f1 28->32 29->28 33 4038f7 32->33 34 4037f9-4037ff 32->34 37 40390b-403925 GetTempPathW call 40360f 33->37 35 403801-403806 34->35 36 403808-40380e 34->36 35->35 35->36 38 403810-403814 36->38 39 403815-403819 36->39 47 403927-403945 GetWindowsDirectoryW lstrcatW call 40360f 37->47 48 40397d-403995 DeleteFileW call 4030d0 37->48 38->39 41 4038d9-4038e7 call 405f64 39->41 42 40381f-403825 39->42 41->32 58 4038e9-4038ea 41->58 45 403827-40382e 42->45 46 40383f-403878 42->46 51 403830-403833 45->51 52 403835 45->52 53 403894-4038ce 46->53 54 40387a-40387f 46->54 47->48 62 403947-403977 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 40360f 47->62 64 40399b-4039a1 48->64 65 403b6c-403b7a ExitProcess CoUninitialize 48->65 51->46 51->52 52->46 56 4038d0-4038d4 53->56 57 4038d6-4038d8 53->57 54->53 60 403881-403889 54->60 56->57 63 4038f9-403906 call 406668 56->63 57->41 58->32 66 403890 60->66 67 40388b-40388e 60->67 62->48 62->65 63->37 69 4039a7-4039ba call 405f64 64->69 70 403a48-403a4f call 403d17 64->70 72 403b91-403b97 65->72 73 403b7c-403b8b call 405cc8 ExitProcess 65->73 66->53 67->53 67->66 88 403a0c-403a19 69->88 89 4039bc-4039f1 69->89 83 403a54-403a57 70->83 74 403b99-403bae GetCurrentProcess OpenProcessToken 72->74 75 403c0f-403c17 72->75 80 403bb0-403bd9 LookupPrivilegeValueW AdjustTokenPrivileges 74->80 81 403bdf-403bed call 406a35 74->81 84 403c19 75->84 85 403c1c-403c1f ExitProcess 75->85 80->81 95 403bfb-403c06 ExitWindowsEx 81->95 96 403bef-403bf9 81->96 83->65 84->85 90 403a1b-403a29 call 40603f 88->90 91 403a5c-403a70 call 405c33 lstrcatW 88->91 93 4039f3-4039f7 89->93 90->65 104 403a2f-403a45 call 406668 * 2 90->104 107 403a72-403a78 lstrcatW 91->107 108 403a7d-403a97 lstrcatW lstrcmpiW 91->108 98 403a00-403a08 93->98 99 4039f9-4039fe 93->99 95->75 101 403c08-403c0a call 40140b 95->101 96->95 96->101 98->93 103 403a0a 98->103 99->98 99->103 101->75 103->88 104->70 107->108 109 403b6a 108->109 110 403a9d-403aa0 108->110 109->65 112 403aa2-403aa7 call 405b99 110->112 113 403aa9 call 405c16 110->113 119 403aae-403abe SetCurrentDirectoryW 112->119 113->119 121 403ac0-403ac6 call 406668 119->121 122 403acb-403af7 call 406668 119->122 121->122 126 403afc-403b17 call 4066a5 DeleteFileW 122->126 129 403b57-403b61 126->129 130 403b19-403b29 CopyFileW 126->130 129->126 132 403b63-403b65 call 406428 129->132 130->129 131 403b2b-403b4b call 406428 call 4066a5 call 405c4b 130->131 131->129 140 403b4d-403b54 CloseHandle 131->140 132->109 140->129
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00008001), ref: 00403663
                                                                                                                                                                                                                            • GetVersionExW.KERNEL32(?), ref: 0040368C
                                                                                                                                                                                                                            • GetVersionExW.KERNEL32(0000011C), ref: 004036A3
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
                                                                                                                                                                                                                            • #17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
                                                                                                                                                                                                                            • OleInitialize.OLE32(00000000), ref: 0040377D
                                                                                                                                                                                                                            • SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
                                                                                                                                                                                                                            • GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
                                                                                                                                                                                                                            • CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force,00000020,"C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force,00000000), ref: 004037E9
                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(1033), ref: 00403982
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force,00000000,?), ref: 00403A69
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force,00000000,?), ref: 00403A78
                                                                                                                                                                                                                              • Part of subcall function 00405C16: CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force,00000000,?), ref: 00403A83
                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force,00000000,?), ref: 00403A8F
                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(00420F08,00420F08,?,6367156,?), ref: 00403B0E
                                                                                                                                                                                                                            • CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,00420F08,00000001), ref: 00403B21
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
                                                                                                                                                                                                                            • ExitProcess.KERNEL32(?), ref: 00403B6C
                                                                                                                                                                                                                            • CoUninitialize.COMBASE(?), ref: 00403B71
                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00403B8B
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
                                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
                                                                                                                                                                                                                            • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
                                                                                                                                                                                                                            • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
                                                                                                                                                                                                                            • ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
                                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00403C1F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
                                                                                                                                                                                                                            • String ID: "C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp" /internal 1730700255692837 /force$.tmp$1033$6367156$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp$C:\Users\user\PCAppStore$C:\Users\user\PCAppStore$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                                                            • API String ID: 2292928366-2339829372
                                                                                                                                                                                                                            • Opcode ID: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
                                                                                                                                                                                                                            • Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D
                                                                                                                                                                                                                            Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 346 405d74-405d9a call 40603f 349 405db3-405dba 346->349 350 405d9c-405dae DeleteFileW 346->350 352 405dbc-405dbe 349->352 353 405dcd-405ddd call 406668 349->353 351 405f30-405f34 350->351 354 405dc4-405dc7 352->354 355 405ede-405ee3 352->355 361 405dec-405ded call 405f83 353->361 362 405ddf-405dea lstrcatW 353->362 354->353 354->355 355->351 357 405ee5-405ee8 355->357 359 405ef2-405efa call 40699e 357->359 360 405eea-405ef0 357->360 359->351 370 405efc-405f10 call 405f37 call 405d2c 359->370 360->351 365 405df2-405df6 361->365 362->365 366 405e02-405e08 lstrcatW 365->366 367 405df8-405e00 365->367 369 405e0d-405e29 lstrlenW FindFirstFileW 366->369 367->366 367->369 371 405ed3-405ed7 369->371 372 405e2f-405e37 369->372 386 405f12-405f15 370->386 387 405f28-405f2b call 4056ca 370->387 371->355 377 405ed9 371->377 374 405e57-405e6b call 406668 372->374 375 405e39-405e41 372->375 388 405e82-405e8d call 405d2c 374->388 389 405e6d-405e75 374->389 378 405e43-405e4b 375->378 379 405eb6-405ec6 FindNextFileW 375->379 377->355 378->374 382 405e4d-405e55 378->382 379->372 385 405ecc-405ecd FindClose 379->385 382->374 382->379 385->371 386->360 392 405f17-405f26 call 4056ca call 406428 386->392 387->351 397 405eae-405eb1 call 4056ca 388->397 398 405e8f-405e92 388->398 389->379 393 405e77-405e80 call 405d74 389->393 392->351 393->379 397->379 401 405e94-405ea4 call 4056ca call 406428 398->401 402 405ea6-405eac 398->402 401->379 402->379
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,?,74DF3420,74DF2EE0,00000000), ref: 00405D9D
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405DE5
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405E08
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405E0E
                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405E1E
                                                                                                                                                                                                                            • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 00405ECD
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                            • String ID: .$.$C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\*.*$\*.*
                                                                                                                                                                                                                            • API String ID: 2035342205-1892671190
                                                                                                                                                                                                                            • Opcode ID: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
                                                                                                                                                                                                                            • Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE
                                                                                                                                                                                                                            Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 566 406d5f-406d64 567 406dd5-406df3 566->567 568 406d66-406d95 566->568 569 4073cb-4073e0 567->569 570 406d97-406d9a 568->570 571 406d9c-406da0 568->571 572 4073e2-4073f8 569->572 573 4073fa-407410 569->573 574 406dac-406daf 570->574 575 406da2-406da6 571->575 576 406da8 571->576 577 407413-40741a 572->577 573->577 578 406db1-406dba 574->578 579 406dcd-406dd0 574->579 575->574 576->574 583 407441-40744d 577->583 584 40741c-407420 577->584 580 406dbc 578->580 581 406dbf-406dcb 578->581 582 406fa2-406fc0 579->582 580->581 585 406e35-406e63 581->585 589 406fc2-406fd6 582->589 590 406fd8-406fea 582->590 592 406be3-406bec 583->592 586 407426-40743e 584->586 587 4075cf-4075d9 584->587 593 406e65-406e7d 585->593 594 406e7f-406e99 585->594 586->583 591 4075e5-4075f8 587->591 595 406fed-406ff7 589->595 590->595 599 4075fd-407601 591->599 596 406bf2 592->596 597 4075fa 592->597 598 406e9c-406ea6 593->598 594->598 600 406ff9 595->600 601 406f9a-406fa0 595->601 603 406bf9-406bfd 596->603 604 406d39-406d5a 596->604 605 406c9e-406ca2 596->605 606 406d0e-406d12 596->606 597->599 608 406eac 598->608 609 406e1d-406e23 598->609 617 407581-40758b 600->617 618 406f7f-406f97 600->618 601->582 607 406f3e-406f48 601->607 603->591 610 406c03-406c10 603->610 604->569 619 406ca8-406cc1 605->619 620 40754e-407558 605->620 611 406d18-406d2c 606->611 612 40755d-407567 606->612 613 40758d-407597 607->613 614 406f4e-407117 607->614 625 406e02-406e1a 608->625 626 407569-407573 608->626 615 406ed6-406edc 609->615 616 406e29-406e2f 609->616 610->597 624 406c16-406c5c 610->624 627 406d2f-406d37 611->627 612->591 613->591 614->592 622 406f3a 615->622 623 406ede-406efc 615->623 616->585 616->622 617->591 618->601 629 406cc4-406cc8 619->629 620->591 622->607 630 406f14-406f26 623->630 631 406efe-406f12 623->631 632 406c84-406c86 624->632 633 406c5e-406c62 624->633 625->609 626->591 627->604 627->606 629->605 634 406cca-406cd0 629->634 637 406f29-406f33 630->637 631->637 640 406c94-406c9c 632->640 641 406c88-406c92 632->641 638 406c64-406c67 GlobalFree 633->638 639 406c6d-406c7b GlobalAlloc 633->639 635 406cd2-406cd9 634->635 636 406cfa-406d0c 634->636 642 406ce4-406cf4 GlobalAlloc 635->642 643 406cdb-406cde GlobalFree 635->643 636->627 637->615 644 406f35 637->644 638->639 639->597 645 406c81 639->645 640->629 641->640 641->641 642->597 642->636 643->642 647 407575-40757f 644->647 648 406ebb-406ed3 644->648 645->632 647->591 648->615
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
                                                                                                                                                                                                                            • Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45
                                                                                                                                                                                                                            Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(74DF3420,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0), ref: 004069A9
                                                                                                                                                                                                                            • FindClose.KERNEL32(00000000), ref: 004069B5
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2295610775-0
                                                                                                                                                                                                                            • Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
                                                                                                                                                                                                                            • Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC
                                                                                                                                                                                                                            Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 141 403d17-403d2f call 406a35 144 403d31-403d41 call 4065af 141->144 145 403d43-403d7a call 406536 141->145 154 403d9d-403dc6 call 403fed call 40603f 144->154 150 403d92-403d98 lstrcatW 145->150 151 403d7c-403d8d call 406536 145->151 150->154 151->150 159 403e58-403e60 call 40603f 154->159 160 403dcc-403dd1 154->160 166 403e62-403e69 call 4066a5 159->166 167 403e6e-403e93 LoadImageW 159->167 160->159 162 403dd7-403dff call 406536 160->162 162->159 168 403e01-403e05 162->168 166->167 170 403f14-403f1c call 40140b 167->170 171 403e95-403ec5 RegisterClassW 167->171 172 403e17-403e23 lstrlenW 168->172 173 403e07-403e14 call 405f64 168->173 184 403f26-403f31 call 403fed 170->184 185 403f1e-403f21 170->185 174 403fe3 171->174 175 403ecb-403f0f SystemParametersInfoW CreateWindowExW 171->175 179 403e25-403e33 lstrcmpiW 172->179 180 403e4b-403e53 call 405f37 call 406668 172->180 173->172 178 403fe5-403fec 174->178 175->170 179->180 183 403e35-403e3f GetFileAttributesW 179->183 180->159 187 403e41-403e43 183->187 188 403e45-403e46 call 405f83 183->188 194 403f37-403f51 ShowWindow call 4069c5 184->194 195 403fba-403fc2 call 40579d 184->195 185->178 187->180 187->188 188->180 200 403f53-403f58 call 4069c5 194->200 201 403f5d-403f6f GetClassInfoW 194->201 202 403fc4-403fca 195->202 203 403fdc-403fde call 40140b 195->203 200->201 206 403f71-403f81 GetClassInfoW RegisterClassW 201->206 207 403f87-403fb8 DialogBoxParamW call 40140b call 403c67 201->207 202->185 208 403fd0-403fd7 call 40140b 202->208 203->174 206->207 207->178 208->185
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
                                                                                                                                                                                                                              • Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403D98
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420), ref: 00403E18
                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(?,.exe,get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(get,?,00000000,?), ref: 00403E36
                                                                                                                                                                                                                            • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\PCAppStore), ref: 00403E7F
                                                                                                                                                                                                                              • Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC
                                                                                                                                                                                                                            • RegisterClassW.USER32(00429200), ref: 00403EBC
                                                                                                                                                                                                                            • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ED4
                                                                                                                                                                                                                            • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F09
                                                                                                                                                                                                                            • ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403F6B
                                                                                                                                                                                                                            • GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403F78
                                                                                                                                                                                                                            • RegisterClassW.USER32(00429200), ref: 00403F81
                                                                                                                                                                                                                            • DialogBoxParamW.USER32(?,00000000,004040C5,00000000), ref: 00403FA0
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                            • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\PCAppStore$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$get
                                                                                                                                                                                                                            • API String ID: 1975747703-284748347
                                                                                                                                                                                                                            • Opcode ID: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
                                                                                                                                                                                                                            • Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D
                                                                                                                                                                                                                            Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 215 4030d0-40311e GetTickCount GetModuleFileNameW call 406158 218 403120-403125 215->218 219 40312a-403158 call 406668 call 405f83 call 406668 GetFileSize 215->219 220 40336a-40336e 218->220 227 403243-403251 call 40302e 219->227 228 40315e 219->228 234 403322-403327 227->234 235 403257-40325a 227->235 230 403163-40317a 228->230 232 40317c 230->232 233 40317e-403187 call 4035e2 230->233 232->233 241 40318d-403194 233->241 242 4032de-4032e6 call 40302e 233->242 234->220 237 403286-4032d2 GlobalAlloc call 406b90 call 406187 CreateFileW 235->237 238 40325c-403274 call 4035f8 call 4035e2 235->238 266 4032d4-4032d9 237->266 267 4032e8-403318 call 4035f8 call 403371 237->267 238->234 261 40327a-403280 238->261 246 403210-403214 241->246 247 403196-4031aa call 406113 241->247 242->234 251 403216-40321d call 40302e 246->251 252 40321e-403224 246->252 247->252 264 4031ac-4031b3 247->264 251->252 257 403233-40323b 252->257 258 403226-403230 call 406b22 252->258 257->230 265 403241 257->265 258->257 261->234 261->237 264->252 270 4031b5-4031bc 264->270 265->227 266->220 276 40331d-403320 267->276 270->252 272 4031be-4031c5 270->272 272->252 273 4031c7-4031ce 272->273 273->252 275 4031d0-4031f0 273->275 275->234 277 4031f6-4031fa 275->277 276->234 278 403329-40333a 276->278 279 403202-40320a 277->279 280 4031fc-403200 277->280 281 403342-403347 278->281 282 40333c 278->282 279->252 283 40320c-40320e 279->283 280->265 280->279 284 403348-40334e 281->284 282->281 283->252 284->284 285 403350-403368 call 406113 284->285 285->220
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004030E4
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,00000400), ref: 00403100
                                                                                                                                                                                                                              • Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                                                              • Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,80000000,00000003), ref: 00403149
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 0040328B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                                                            • API String ID: 2803837635-300999371
                                                                                                                                                                                                                            • Opcode ID: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
                                                                                                                                                                                                                            • Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D
                                                                                                                                                                                                                            Function 004066A5 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 196stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 288 4066a5-4066b0 289 4066b2-4066c1 288->289 290 4066c3-4066d9 288->290 289->290 291 4066f1-4066fa 290->291 292 4066db-4066e8 290->292 294 406700 291->294 295 4068d5-4068e0 291->295 292->291 293 4066ea-4066ed 292->293 293->291 296 406705-406712 294->296 297 4068e2-4068e6 call 406668 295->297 298 4068eb-4068ec 295->298 296->295 299 406718-406721 296->299 297->298 301 4068b3 299->301 302 406727-406764 299->302 303 4068c1-4068c4 301->303 304 4068b5-4068bf 301->304 305 406857-40685c 302->305 306 40676a-406771 302->306 307 4068c6-4068cf 303->307 304->307 308 40685e-406864 305->308 309 40688f-406894 305->309 310 406773-406775 306->310 311 406776-406778 306->311 307->295 312 406702 307->312 313 406874-406880 call 406668 308->313 314 406866-406872 call 4065af 308->314 317 4068a3-4068b1 lstrlenW 309->317 318 406896-40689e call 4066a5 309->318 310->311 315 4067b5-4067b8 311->315 316 40677a-4067a1 call 406536 311->316 312->296 329 406885-40688b 313->329 314->329 319 4067c8-4067cb 315->319 320 4067ba-4067c6 GetSystemDirectoryW 315->320 333 40683e-406842 316->333 335 4067a7-4067b0 call 4066a5 316->335 317->307 318->317 326 406834-406836 319->326 327 4067cd-4067db GetWindowsDirectoryW 319->327 325 406838-40683c 320->325 325->333 334 40684f-406855 call 4068ef 325->334 326->325 332 4067dd-4067e5 326->332 327->326 329->317 331 40688d 329->331 331->334 339 4067e7-4067f0 332->339 340 4067fc-406812 SHGetSpecialFolderLocation 332->340 333->334 336 406844-40684a lstrcatW 333->336 334->317 335->325 336->334 345 4067f8-4067fa 339->345 343 406830 340->343 344 406814-40682e SHGetPathFromIDListW CoTaskMemFree 340->344 343->326 344->325 344->343 345->325 345->340
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(get,00000400), ref: 004067C0
                                                                                                                                                                                                                            • GetWindowsDirectoryW.KERNEL32(get,00000400,00000000,00422728,?,00405701,00422728,00000000,00000000,00000000,00000000), ref: 004067D3
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Directory$SystemWindowslstrcatlstrlen
                                                                                                                                                                                                                            • String ID: 6367156$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$get
                                                                                                                                                                                                                            • API String ID: 4260037668-2251866876
                                                                                                                                                                                                                            • Opcode ID: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
                                                                                                                                                                                                                            • Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D
                                                                                                                                                                                                                            Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 410 40176f-401794 call 402da6 call 405fae 415 401796-40179c call 406668 410->415 416 40179e-4017b0 call 406668 call 405f37 lstrcatW 410->416 421 4017b5-4017b6 call 4068ef 415->421 416->421 425 4017bb-4017bf 421->425 426 4017c1-4017cb call 40699e 425->426 427 4017f2-4017f5 425->427 434 4017dd-4017ef 426->434 435 4017cd-4017db CompareFileTime 426->435 428 4017f7-4017f8 call 406133 427->428 429 4017fd-401819 call 406158 427->429 428->429 437 40181b-40181e 429->437 438 40188d-4018b6 call 4056ca call 403371 429->438 434->427 435->434 439 401820-40185e call 406668 * 2 call 4066a5 call 406668 call 405cc8 437->439 440 40186f-401879 call 4056ca 437->440 450 4018b8-4018bc 438->450 451 4018be-4018ca SetFileTime 438->451 439->425 472 401864-401865 439->472 452 401882-401888 440->452 450->451 454 4018d0-4018db CloseHandle 450->454 451->454 455 402c33 452->455 457 4018e1-4018e4 454->457 458 402c2a-402c2d 454->458 459 402c35-402c39 455->459 462 4018e6-4018f7 call 4066a5 lstrcatW 457->462 463 4018f9-4018fc call 4066a5 457->463 458->455 469 401901-4023a2 call 405cc8 462->469 463->469 469->458 469->459 472->452 474 401867-401868 472->474 474->440
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017B0
                                                                                                                                                                                                                            • CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017D5
                                                                                                                                                                                                                              • Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp$C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\inetc.dll$C:\Users\user\PCAppStore$get
                                                                                                                                                                                                                            • API String ID: 1941528284-3877404472
                                                                                                                                                                                                                            • Opcode ID: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
                                                                                                                                                                                                                            • Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E
                                                                                                                                                                                                                            Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 476 4069c5-4069e5 GetSystemDirectoryW 477 4069e7 476->477 478 4069e9-4069eb 476->478 477->478 479 4069fc-4069fe 478->479 480 4069ed-4069f6 478->480 482 4069ff-406a32 wsprintfW LoadLibraryExW 479->482 480->479 481 4069f8-4069fa 480->481 481->482
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00406A17
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                            • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                                                            • API String ID: 2200240437-1946221925
                                                                                                                                                                                                                            • Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
                                                                                                                                                                                                                            • Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98
                                                                                                                                                                                                                            Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00402A06
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00402A19
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2667972263-0
                                                                                                                                                                                                                            • Opcode ID: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
                                                                                                                                                                                                                            • Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58
                                                                                                                                                                                                                            Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 519 405b99-405be4 CreateDirectoryW 520 405be6-405be8 519->520 521 405bea-405bf7 GetLastError 519->521 522 405c11-405c13 520->522 521->522 523 405bf9-405c0d SetFileSecurityW 521->523 523->520 524 405c0f GetLastError 523->524 524->522
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405BF0
                                                                                                                                                                                                                            • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405C0F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                            • API String ID: 3449924974-3081826266
                                                                                                                                                                                                                            • Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
                                                                                                                                                                                                                            • Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99
                                                                                                                                                                                                                            Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 525 40248a-4024bb call 402da6 * 2 call 402e36 532 4024c1-4024cb 525->532 533 402c2a-402c39 525->533 535 4024cd-4024da call 402da6 lstrlenW 532->535 536 4024de-4024e1 532->536 535->536 539 4024e3-4024f4 call 402d84 536->539 540 4024f5-4024f8 536->540 539->540 543 402509-40251d RegSetValueExW 540->543 544 4024fa-402504 call 403371 540->544 546 402522-402603 RegCloseKey 543->546 547 40251f 543->547 544->543 546->533 550 40292e-402935 546->550 547->546 550->533
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsv9D19.tmp,00000023,00000011,00000002), ref: 004024D5
                                                                                                                                                                                                                            • RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsv9D19.tmp,00000000,00000011,00000002), ref: 00402515
                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsv9D19.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseValuelstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp
                                                                                                                                                                                                                            • API String ID: 2655323295-2453543522
                                                                                                                                                                                                                            • Opcode ID: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
                                                                                                                                                                                                                            • Instruction ID: a516967871aadb8e7373f7254d3c24ec0cdbd982f2b4049ed7d94b0996b6da2b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4011AF71E00108BEEF10AFA1CE49EAEB6B8EB44354F11443AF404B61C1DBB98D409658
                                                                                                                                                                                                                            Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 551 406187-406193 552 406194-4061c8 GetTickCount GetTempFileNameW 551->552 553 4061d7-4061d9 552->553 554 4061ca-4061cc 552->554 556 4061d1-4061d4 553->556 554->552 555 4061ce 554->555 555->556
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004061A5
                                                                                                                                                                                                                            • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CountFileNameTempTick
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                                            • API String ID: 1716503409-678247507
                                                                                                                                                                                                                            • Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
                                                                                                                                                                                                                            • Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768
                                                                                                                                                                                                                            Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 557 403c25-403c34 558 403c40-403c48 557->558 559 403c36-403c39 CloseHandle 557->559 560 403c54-403c60 call 403c82 call 405d74 558->560 561 403c4a-403c4d CloseHandle 558->561 559->558 565 403c65-403c66 560->565 561->560
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\, xrefs: 00403C5B
                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseHandle
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\
                                                                                                                                                                                                                            • API String ID: 2962429428-806446047
                                                                                                                                                                                                                            • Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
                                                                                                                                                                                                                            • Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D
                                                                                                                                                                                                                            Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 649 4015c1-4015d5 call 402da6 call 405fe2 654 401631-401634 649->654 655 4015d7-4015ea call 405f64 649->655 656 401663-4022f6 call 401423 654->656 657 401636-401655 call 401423 call 406668 SetCurrentDirectoryW 654->657 662 401604-401607 call 405c16 655->662 663 4015ec-4015ef 655->663 673 402c2a-402c39 656->673 674 40292e-402935 656->674 657->673 676 40165b-40165e 657->676 672 40160c-40160e 662->672 663->662 666 4015f1-4015f8 call 405c33 663->666 666->662 680 4015fa-4015fd call 405b99 666->680 678 401610-401615 672->678 679 401627-40162f 672->679 674->673 676->673 682 401624 678->682 683 401617-401622 GetFileAttributesW 678->683 679->654 679->655 685 401602 680->685 682->679 683->679 683->682 685->672
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0,00000000), ref: 00405FF0
                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                                                              • Part of subcall function 00405B99: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
                                                                                                                                                                                                                            • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\PCAppStore,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\PCAppStore, xrefs: 00401640
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                            • String ID: C:\Users\user\PCAppStore
                                                                                                                                                                                                                            • API String ID: 1892508949-1816341478
                                                                                                                                                                                                                            • Opcode ID: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
                                                                                                                                                                                                                            • Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E
                                                                                                                                                                                                                            Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 686 40603f-40605a call 406668 call 405fe2 691 406060-40606d call 4068ef 686->691 692 40605c-40605e 686->692 696 40607d-406081 691->696 697 40606f-406075 691->697 693 4060b8-4060ba 692->693 699 406097-4060a0 lstrlenW 696->699 697->692 698 406077-40607b 697->698 698->692 698->696 700 4060a2-4060b6 call 405f37 GetFileAttributesW 699->700 701 406083-40608a call 40699e 699->701 700->693 706 406091-406092 call 405f83 701->706 707 40608c-40608f 701->707 706->699 707->692 707->706
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675
                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0,00000000), ref: 00405FF0
                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
                                                                                                                                                                                                                              • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0,00000000), ref: 00406098
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0), ref: 004060A8
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                            • String ID: P_B
                                                                                                                                                                                                                            • API String ID: 3248276644-906794629
                                                                                                                                                                                                                            • Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
                                                                                                                                                                                                                            • Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E
                                                                                                                                                                                                                            Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
                                                                                                                                                                                                                            • Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45
                                                                                                                                                                                                                            Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
                                                                                                                                                                                                                            • Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45
                                                                                                                                                                                                                            Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
                                                                                                                                                                                                                            • Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05
                                                                                                                                                                                                                            Function 00406BB0 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
                                                                                                                                                                                                                            • Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45
                                                                                                                                                                                                                            Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
                                                                                                                                                                                                                            • Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05
                                                                                                                                                                                                                            Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
                                                                                                                                                                                                                            • Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05
                                                                                                                                                                                                                            Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
                                                                                                                                                                                                                            • Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45
                                                                                                                                                                                                                            Function 00403479 Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040348D
                                                                                                                                                                                                                              • Part of subcall function 004035F8: SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(12F86091,00000000,00000000,00414EF0,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FilePointer$CountTick
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1092082344-0
                                                                                                                                                                                                                            • Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
                                                                                                                                                                                                                            • Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D
                                                                                                                                                                                                                            Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 334405425-0
                                                                                                                                                                                                                            • Opcode ID: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
                                                                                                                                                                                                                            • Instruction ID: 1e7e134340f86907485d462c64894228b35b3344cd4f3d252167f9901203d809
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C521C231904104FADF11AFA5CF48A9D7A70BF48354F60413BF605B91E0DBBD8A929A5D
                                                                                                                                                                                                                            Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(0385F168), ref: 00401C0B
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D
                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global$AllocFreelstrcatlstrlen
                                                                                                                                                                                                                            • String ID: get
                                                                                                                                                                                                                            • API String ID: 3292104215-4248514160
                                                                                                                                                                                                                            • Opcode ID: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
                                                                                                                                                                                                                            • Instruction ID: d74cddccbdd50a14e5bf5e3e63826a63b2a65df0fd836753f00777670cd3b466
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5321D872904210DBDB20EFA4DEC4E5E73A4AB047157150A3BF542F72D0D6BD9C518BAD
                                                                                                                                                                                                                            Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
                                                                                                                                                                                                                            • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsv9D19.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Enum$CloseValue
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 397863658-0
                                                                                                                                                                                                                            • Opcode ID: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
                                                                                                                                                                                                                            • Instruction ID: fdd171a53236be04b49e80cc8c25aaf428e2db1c32e81cf7e645575326a8d696
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 35017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61D0EBB85E45966D
                                                                                                                                                                                                                            Function 00405D2C Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00406133: GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
                                                                                                                                                                                                                              • Part of subcall function 00406133: SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C
                                                                                                                                                                                                                            • RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D47
                                                                                                                                                                                                                            • DeleteFileW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D4F
                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D67
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1655745494-0
                                                                                                                                                                                                                            • Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
                                                                                                                                                                                                                            • Instruction ID: f7500ddcb6900c42920b0fa7cdf939b3a50fd8fb6693fff67202f671924a8b23
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6DE0E531218A9156C3207734AD0CB5B2A98EF86314F09893FF5A2B11E0D77885078AAD
                                                                                                                                                                                                                            Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\PCAppStore, xrefs: 00402269
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateInstance
                                                                                                                                                                                                                            • String ID: C:\Users\user\PCAppStore
                                                                                                                                                                                                                            • API String ID: 542301482-1816341478
                                                                                                                                                                                                                            • Opcode ID: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
                                                                                                                                                                                                                            • Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94
                                                                                                                                                                                                                            Function 004064D5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,00422728,?,('B,00406563,('B,00000000,?,?,get,?), ref: 004064F9
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Open
                                                                                                                                                                                                                            • String ID: ('B
                                                                                                                                                                                                                            • API String ID: 71445658-2332581011
                                                                                                                                                                                                                            • Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                            • Instruction ID: 5036765eb4ab6e58186d81024f5778724aa2024cd81e2e1d5ca813995cf5404a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BAD0123210020DBBDF115F90AD01FAB375DAB08310F018426FE06A4092D775D534A728
                                                                                                                                                                                                                            Function 00403371 Relevance: 3.1, APIs: 2, Instructions: 88COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FilePointer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 973152223-0
                                                                                                                                                                                                                            • Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
                                                                                                                                                                                                                            • Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9
                                                                                                                                                                                                                            Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
                                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsv9D19.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3356406503-0
                                                                                                                                                                                                                            • Opcode ID: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
                                                                                                                                                                                                                            • Instruction ID: eaee0c709954dca67eb2d1c59e66f6ca2c08a593dad46a4828cc6951ae7b5872
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5C116D71900219EBDF14DFA4DE589AE7774FF04345B20443BE401B62D0E7B88A45EB5D
                                                                                                                                                                                                                            Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3850602802-0
                                                                                                                                                                                                                            • Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
                                                                                                                                                                                                                            • Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D
                                                                                                                                                                                                                            Function 00405C4B Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 00405C81
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3712363035-0
                                                                                                                                                                                                                            • Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
                                                                                                                                                                                                                            • Instruction ID: 91309136e62a13352d93043ad9bb7922807806bb2ea2f765c8e9c4a894a003d9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 59E0B6B4600209BFFB109B64EE09F7B7BADFB04648F414565BD51F2190D778A8158A78
                                                                                                                                                                                                                            Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,?), ref: 00406A62
                                                                                                                                                                                                                              • Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
                                                                                                                                                                                                                              • Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
                                                                                                                                                                                                                              • Part of subcall function 004069C5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2547128583-0
                                                                                                                                                                                                                            • Opcode ID: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
                                                                                                                                                                                                                            • Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79
                                                                                                                                                                                                                            Function 00403C82 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,74DF3420,00000000,74DF2EE0,00403C59,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C9C
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 00403CA3
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1100898210-0
                                                                                                                                                                                                                            • Opcode ID: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
                                                                                                                                                                                                                            • Instruction ID: 1b4b668df254a36c82b8f96f79c5ae0e05fb6c29bd97d86a5de4613e9375b038
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0AE08C335052205BD6211F55EA0875A7768AF94B26F06006AE980BB26087781C424BC8
                                                                                                                                                                                                                            Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$AttributesCreate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 415043291-0
                                                                                                                                                                                                                            • Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
                                                                                                                                                                                                                            • Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19
                                                                                                                                                                                                                            Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
                                                                                                                                                                                                                            • SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AttributesFile
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3188754299-0
                                                                                                                                                                                                                            • Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                            • Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98
                                                                                                                                                                                                                            Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00405C2A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1375471231-0
                                                                                                                                                                                                                            • Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
                                                                                                                                                                                                                            • Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D
                                                                                                                                                                                                                            Function 00406503 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 0040652C
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Create
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2289755597-0
                                                                                                                                                                                                                            • Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                            • Instruction ID: 390987c888b9fe28ccc3a202ccefe0e129b8fdbaba7b34d45eb5723cdb444700
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1E0ECB2010109BEEF099F90EC0ADBB372DEB04704F41492EF907E4091E6B5AE70AA34
                                                                                                                                                                                                                            Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000,00412A94,0040CEF0,00403579,0040CEF0,00412A94,00414EF0,00004000,?,00000000,004033A3,00000004), ref: 0040621E
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileWrite
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3934441357-0
                                                                                                                                                                                                                            • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                            • Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5
                                                                                                                                                                                                                            Function 004061DB Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,004035F5,?,?,004034F9,00414EF0,00004000,?,00000000,004033A3), ref: 004061EF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileRead
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2738559852-0
                                                                                                                                                                                                                            • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                            • Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8
                                                                                                                                                                                                                            Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FilePointer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 973152223-0
                                                                                                                                                                                                                            • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                            • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                                                                                                                                                                                                            Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                              • Part of subcall function 00405C4B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
                                                                                                                                                                                                                              • Part of subcall function 00405C4B: CloseHandle.KERNEL32(?), ref: 00405C81
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                                                              • Part of subcall function 00406AE0: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
                                                                                                                                                                                                                              • Part of subcall function 00406AE0: GetExitCodeProcess.KERNEL32(?,?), ref: 00406B13
                                                                                                                                                                                                                              • Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2972824698-0
                                                                                                                                                                                                                            • Opcode ID: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
                                                                                                                                                                                                                            • Instruction ID: 7fe263eab699b123ac8c37dffe14ee58438593542e676086741668bd6549bbba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3DF09072905112EBDF21BBA59AC4DAE76A4DF01318B25453BE102B21E0D77C4E528A6E

                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                            Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000403), ref: 00405867
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EE), ref: 00405876
                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 004058B3
                                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000002), ref: 004058BA
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000008), ref: 00405956
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 00405977
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F8), ref: 00405885
                                                                                                                                                                                                                              • Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003EC), ref: 004059C9
                                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 004059DE
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 00405A02
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000008), ref: 00405A07
                                                                                                                                                                                                                            • ShowWindow.USER32(00000008), ref: 00405A51
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
                                                                                                                                                                                                                            • CreatePopupMenu.USER32 ref: 00405A96
                                                                                                                                                                                                                            • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405AAA
                                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 00405ACA
                                                                                                                                                                                                                            • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
                                                                                                                                                                                                                            • OpenClipboard.USER32(00000000), ref: 00405B2B
                                                                                                                                                                                                                            • EmptyClipboard.USER32 ref: 00405B31
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
                                                                                                                                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 00405B47
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
                                                                                                                                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
                                                                                                                                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 00405B86
                                                                                                                                                                                                                            • CloseClipboard.USER32 ref: 00405B8C
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                            • String ID: H7B${
                                                                                                                                                                                                                            • API String ID: 590372296-2256286769
                                                                                                                                                                                                                            • Opcode ID: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
                                                                                                                                                                                                                            • Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68
                                                                                                                                                                                                                            Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003F9), ref: 00405049
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000408), ref: 00405054
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
                                                                                                                                                                                                                            • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 004050B5
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000FC,0040563E), ref: 004050CE
                                                                                                                                                                                                                            • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
                                                                                                                                                                                                                            • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 0040512B
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D
                                                                                                                                                                                                                              • Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 0040526F
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040527D
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000005), ref: 0040528D
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
                                                                                                                                                                                                                            • ImageList_Destroy.COMCTL32(?), ref: 0040545B
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(?), ref: 0040546B
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
                                                                                                                                                                                                                            • InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000000), ref: 00405615
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FE), ref: 00405620
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000), ref: 00405627
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                            • String ID: $M$N
                                                                                                                                                                                                                            • API String ID: 2564846305-813528018
                                                                                                                                                                                                                            • Opcode ID: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
                                                                                                                                                                                                                            • Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18
                                                                                                                                                                                                                            Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
                                                                                                                                                                                                                            • ShowWindow.USER32(?), ref: 00404121
                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000F0), ref: 00404133
                                                                                                                                                                                                                            • ShowWindow.USER32(?,00000004), ref: 0040414C
                                                                                                                                                                                                                            • DestroyWindow.USER32 ref: 00404160
                                                                                                                                                                                                                            • SetWindowLongW.USER32(?,00000000,00000000), ref: 00404179
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 00404198
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
                                                                                                                                                                                                                            • IsWindowEnabled.USER32(00000000), ref: 004041B3
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000001), ref: 0040425E
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000002), ref: 00404268
                                                                                                                                                                                                                            • SetClassLongW.USER32(?,000000F2,?), ref: 00404282
                                                                                                                                                                                                                            • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000003), ref: 00404379
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,?), ref: 0040439A
                                                                                                                                                                                                                            • EnableWindow.USER32(?,?), ref: 004043AC
                                                                                                                                                                                                                            • EnableWindow.USER32(?,?), ref: 004043C7
                                                                                                                                                                                                                            • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
                                                                                                                                                                                                                            • EnableMenuItem.USER32(00000000), ref: 004043E4
                                                                                                                                                                                                                            • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,00423748), ref: 0040444D
                                                                                                                                                                                                                            • ShowWindow.USER32(?,0000000A), ref: 00404581
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                                                            • String ID: H7B
                                                                                                                                                                                                                            • API String ID: 1860320154-2300413410
                                                                                                                                                                                                                            • Opcode ID: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
                                                                                                                                                                                                                            • Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E
                                                                                                                                                                                                                            Function 00404783 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 00404835
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 00404863
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?), ref: 00404884
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,0000040A), ref: 004048FF
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000), ref: 00404906
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E8), ref: 00404931
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F02), ref: 00404982
                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 00404985
                                                                                                                                                                                                                            • LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
                                                                                                                                                                                                                            • SetCursor.USER32(00000000), ref: 004049A1
                                                                                                                                                                                                                            • SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
                                                                                                                                                                                                                            • SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                                                            • String ID: N$get
                                                                                                                                                                                                                            • API String ID: 3103080414-214687294
                                                                                                                                                                                                                            • Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
                                                                                                                                                                                                                            • Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9
                                                                                                                                                                                                                            Function 00404AB5 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 275stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003FB), ref: 00404B04
                                                                                                                                                                                                                            • SetWindowTextW.USER32(00000000,?), ref: 00404B2E
                                                                                                                                                                                                                            • SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
                                                                                                                                                                                                                            • CoTaskMemFree.OLE32(00000000), ref: 00404BEA
                                                                                                                                                                                                                            • lstrcmpiW.KERNEL32(get,00423748,00000000,?,?), ref: 00404C1C
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,get), ref: 00404C28
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C3A
                                                                                                                                                                                                                              • Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF
                                                                                                                                                                                                                              • Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
                                                                                                                                                                                                                              • Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
                                                                                                                                                                                                                              • Part of subcall function 004068EF: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
                                                                                                                                                                                                                              • Part of subcall function 004068EF: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979
                                                                                                                                                                                                                            • GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
                                                                                                                                                                                                                            • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18
                                                                                                                                                                                                                              • Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
                                                                                                                                                                                                                              • Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
                                                                                                                                                                                                                              • Part of subcall function 00404E71: SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                            • String ID: 6367156$A$C:\Users\user\PCAppStore$H7B$get
                                                                                                                                                                                                                            • API String ID: 2624150263-22974072
                                                                                                                                                                                                                            • Opcode ID: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
                                                                                                                                                                                                                            • Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69
                                                                                                                                                                                                                            Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2
                                                                                                                                                                                                                              • Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
                                                                                                                                                                                                                              • Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF
                                                                                                                                                                                                                            • GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
                                                                                                                                                                                                                            • wsprintfA.USER32 ref: 0040632D
                                                                                                                                                                                                                            • GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
                                                                                                                                                                                                                            • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
                                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 00406416
                                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D
                                                                                                                                                                                                                              • Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                                                              • Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                                                            • String ID: %ls=%ls$[Rename]$mB$uB$uB
                                                                                                                                                                                                                            • API String ID: 2171350718-2295842750
                                                                                                                                                                                                                            • Opcode ID: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
                                                                                                                                                                                                                            • Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD
                                                                                                                                                                                                                            Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                            • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                            • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                            • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                            • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                            • DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                            • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                            • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                            • String ID: F
                                                                                                                                                                                                                            • API String ID: 941294808-1304234792
                                                                                                                                                                                                                            • Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
                                                                                                                                                                                                                            • Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4
                                                                                                                                                                                                                            Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                            • SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSendlstrlen$lstrcat$TextWindow
                                                                                                                                                                                                                            • String ID: ('B
                                                                                                                                                                                                                            • API String ID: 1495540970-2332581011
                                                                                                                                                                                                                            • Opcode ID: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
                                                                                                                                                                                                                            • Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68
                                                                                                                                                                                                                            Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetWindowLongW.USER32(?,000000EB), ref: 00404648
                                                                                                                                                                                                                            • GetSysColor.USER32(00000000), ref: 00404686
                                                                                                                                                                                                                            • SetTextColor.GDI32(?,00000000), ref: 00404692
                                                                                                                                                                                                                            • SetBkMode.GDI32(?,?), ref: 0040469E
                                                                                                                                                                                                                            • GetSysColor.USER32(?), ref: 004046B1
                                                                                                                                                                                                                            • SetBkColor.GDI32(?,?), ref: 004046C1
                                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 004046DB
                                                                                                                                                                                                                            • CreateBrushIndirect.GDI32(?), ref: 004046E5
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2320649405-0
                                                                                                                                                                                                                            • Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                            • Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58
                                                                                                                                                                                                                            Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • ReadFile.KERNEL32(?,?,?,?), ref: 00402758
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
                                                                                                                                                                                                                              • Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F
                                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                            • String ID: 9
                                                                                                                                                                                                                            • API String ID: 163830602-2366072709
                                                                                                                                                                                                                            • Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
                                                                                                                                                                                                                            • Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58
                                                                                                                                                                                                                            Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
                                                                                                                                                                                                                            • CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
                                                                                                                                                                                                                            • CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
                                                                                                                                                                                                                            • CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Char$Next$Prev
                                                                                                                                                                                                                            • String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                            • API String ID: 589700163-4010320282
                                                                                                                                                                                                                            • Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
                                                                                                                                                                                                                            • Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD
                                                                                                                                                                                                                            Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • DestroyWindow.USER32(00000000,00000000), ref: 00403049
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00403067
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00403095
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                                                              • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                                                              • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                                                            • CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 004030B9
                                                                                                                                                                                                                            • ShowWindow.USER32(00000000,00000005), ref: 004030C7
                                                                                                                                                                                                                              • Part of subcall function 00403012: MulDiv.KERNEL32(00000000,00000064,00015C8B), ref: 00403027
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                                                                                                                                                            • String ID: ... %d%%
                                                                                                                                                                                                                            • API String ID: 722711167-2449383134
                                                                                                                                                                                                                            • Opcode ID: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
                                                                                                                                                                                                                            • Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE
                                                                                                                                                                                                                            Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
                                                                                                                                                                                                                            • GetMessagePos.USER32 ref: 00404FA2
                                                                                                                                                                                                                            • ScreenToClient.USER32(?,?), ref: 00404FBC
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
                                                                                                                                                                                                                            • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                            • String ID: f
                                                                                                                                                                                                                            • API String ID: 41195575-1993550816
                                                                                                                                                                                                                            • Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                            • Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5
                                                                                                                                                                                                                            Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00402FE5
                                                                                                                                                                                                                            • SetWindowTextW.USER32(?,?), ref: 00402FF5
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00000406,?), ref: 00403007
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                            • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                                                                            • API String ID: 1451636040-1158693248
                                                                                                                                                                                                                            • Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
                                                                                                                                                                                                                            • Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59
                                                                                                                                                                                                                            Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
                                                                                                                                                                                                                            • wsprintfW.USER32 ref: 00404F1B
                                                                                                                                                                                                                            • SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                            • String ID: %u.%u%s%s$H7B
                                                                                                                                                                                                                            • API String ID: 3540041739-107966168
                                                                                                                                                                                                                            • Opcode ID: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
                                                                                                                                                                                                                            • Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8
                                                                                                                                                                                                                            Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
                                                                                                                                                                                                                            • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
                                                                                                                                                                                                                            • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseEnum$DeleteValue
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1354259210-0
                                                                                                                                                                                                                            • Opcode ID: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
                                                                                                                                                                                                                            • Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68
                                                                                                                                                                                                                            Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 00401D9A
                                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 00401DE5
                                                                                                                                                                                                                            • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
                                                                                                                                                                                                                            • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
                                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 00401E39
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1849352358-0
                                                                                                                                                                                                                            • Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
                                                                                                                                                                                                                            • Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98
                                                                                                                                                                                                                            Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetDC.USER32(?), ref: 00401E51
                                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
                                                                                                                                                                                                                            • MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
                                                                                                                                                                                                                            • ReleaseDC.USER32(?,00000000), ref: 00401E84
                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                                                              • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                                                            • CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2584051700-0
                                                                                                                                                                                                                            • Opcode ID: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
                                                                                                                                                                                                                            • Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED
                                                                                                                                                                                                                            Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
                                                                                                                                                                                                                            • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessageSend$Timeout
                                                                                                                                                                                                                            • String ID: !
                                                                                                                                                                                                                            • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                            • Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
                                                                                                                                                                                                                            • Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98
                                                                                                                                                                                                                            Function 00406536 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0040A230,00000000,('B,00000000,?,?,get,?,?,0040679D,80000002), ref: 0040657C
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,get,get,get,00000000,00422728), ref: 00406587
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseQueryValue
                                                                                                                                                                                                                            • String ID: ('B$get
                                                                                                                                                                                                                            • API String ID: 3356406503-1955485993
                                                                                                                                                                                                                            • Opcode ID: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
                                                                                                                                                                                                                            • Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4
                                                                                                                                                                                                                            Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
                                                                                                                                                                                                                            • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
                                                                                                                                                                                                                            • lstrcatW.KERNEL32(?,0040A014), ref: 00405F59
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                            • API String ID: 2659869361-3081826266
                                                                                                                                                                                                                            • Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                            • Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED
                                                                                                                                                                                                                            Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\inetc.dll), ref: 00402695
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: lstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp\nsv9D19.tmp$C:\Users\user\AppData\Local\Temp\nsv9D19.tmp\inetc.dll
                                                                                                                                                                                                                            • API String ID: 1659193697-2739836695
                                                                                                                                                                                                                            • Opcode ID: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
                                                                                                                                                                                                                            • Instruction ID: f1e3379d491753f9d96dc3c217618d2e64da59e9cc8309568291ba5d2d488428
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D511C472A00205EBCB10BBB18E4AA9E76619F44758F21483FE402B61C1DAFD8891965F
                                                                                                                                                                                                                            Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • IsWindowVisible.USER32(?), ref: 0040566D
                                                                                                                                                                                                                            • CallWindowProcW.USER32(?,?,?,?), ref: 004056BE
                                                                                                                                                                                                                              • Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                            • Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
                                                                                                                                                                                                                            • Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D
                                                                                                                                                                                                                            Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,80000000,00000003), ref: 00405F89
                                                                                                                                                                                                                            • CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,C:\Users\user\AppData\Local\Temp\nsa4E4E.tmp,80000000,00000003), ref: 00405F99
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • C:\Users\user\AppData\Local\Temp, xrefs: 00405F83
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CharPrevlstrlen
                                                                                                                                                                                                                            • String ID: C:\Users\user\AppData\Local\Temp
                                                                                                                                                                                                                            • API String ID: 2709904686-47812868
                                                                                                                                                                                                                            • Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
                                                                                                                                                                                                                            • Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9
                                                                                                                                                                                                                            Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
                                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004060E5
                                                                                                                                                                                                                            • CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
                                                                                                                                                                                                                            • lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000009.00000002.2421907599.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421857674.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421936741.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2421978643.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000009.00000002.2422274959.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_9_2_400000_nsa4E4E.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 190613189-0
                                                                                                                                                                                                                            • Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
                                                                                                                                                                                                                            • Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:12.8%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:0.4%
                                                                                                                                                                                                                            Total number of Nodes:2000
                                                                                                                                                                                                                            Total number of Limit Nodes:58
                                                                                                                                                                                                                            execution_graph 72939 7ff7bc0997d0 73047 7ff7bc0911a0 72939->73047 72943 7ff7bc099825 allocator 72944 7ff7bc0911a0 _Mpunct 51 API calls 72943->72944 72945 7ff7bc09985a UnDecorator::getVbTableType 72944->72945 72946 7ff7bc0911a0 _Mpunct 51 API calls 72945->72946 72947 7ff7bc09988d 72946->72947 72948 7ff7bc0d98a0 71 API calls 72947->72948 72949 7ff7bc0998aa allocator 72948->72949 72950 7ff7bc0911a0 _Mpunct 51 API calls 72949->72950 72951 7ff7bc0998dc UnDecorator::getVbTableType 72950->72951 72952 7ff7bc0911a0 _Mpunct 51 API calls 72951->72952 72953 7ff7bc09990f 72952->72953 72954 7ff7bc0d98a0 71 API calls 72953->72954 72955 7ff7bc09992c allocator 72954->72955 72956 7ff7bc0911a0 _Mpunct 51 API calls 72955->72956 72957 7ff7bc099961 UnDecorator::getVbTableType 72956->72957 72958 7ff7bc0911a0 _Mpunct 51 API calls 72957->72958 72959 7ff7bc099994 72958->72959 72960 7ff7bc0d98a0 71 API calls 72959->72960 72961 7ff7bc0999b1 allocator 72960->72961 72962 7ff7bc0911a0 _Mpunct 51 API calls 72961->72962 72963 7ff7bc0999e6 UnDecorator::getVbTableType 72962->72963 72964 7ff7bc0911a0 _Mpunct 51 API calls 72963->72964 72965 7ff7bc099a19 72964->72965 72966 7ff7bc0d98a0 71 API calls 72965->72966 72967 7ff7bc099a36 allocator 72966->72967 72968 7ff7bc0911a0 _Mpunct 51 API calls 72967->72968 72969 7ff7bc099a6b UnDecorator::getVbTableType 72968->72969 72970 7ff7bc099a79 GetClassNameW 72969->72970 72971 7ff7bc099ae7 GetWindowTextW 72970->72971 72972 7ff7bc099b59 72970->72972 72971->72972 72973 7ff7bc099b06 72971->72973 73079 7ff7bc0910b0 72972->73079 72975 7ff7bc093c10 shared_ptr 47 API calls 72973->72975 72976 7ff7bc099b1b 72975->72976 72977 7ff7bc093c10 shared_ptr 47 API calls 72976->72977 72978 7ff7bc099b29 72977->72978 72979 7ff7bc093c10 shared_ptr 47 API calls 72978->72979 72980 7ff7bc099b37 72979->72980 72981 7ff7bc093c10 shared_ptr 47 API calls 72980->72981 72982 7ff7bc099b42 72981->72982 72983 7ff7bc093c10 shared_ptr 47 API calls 72982->72983 73008 7ff7bc099b50 72983->73008 72984 7ff7bc099b7e allocator ProcessCodePage UnDecorator::getVbTableType 72985 7ff7bc099bf9 EnumChildWindows EnumChildWindows EnumChildWindows 72984->72985 72986 7ff7bc099cad 72984->72986 73083 7ff7bc093c10 72985->73083 72988 7ff7bc0910b0 51 API calls 72986->72988 73005 7ff7bc099cde allocator ProcessCodePage UnDecorator::getVbTableType 72986->73005 72988->73005 72989 7ff7bc099c6f 72990 7ff7bc093c10 shared_ptr 47 API calls 72989->72990 72991 7ff7bc099c7d 72990->72991 72992 7ff7bc093c10 shared_ptr 47 API calls 72991->72992 72993 7ff7bc099c8b 72992->72993 72998 7ff7bc093c10 shared_ptr 47 API calls 72993->72998 72994 7ff7bc0910b0 51 API calls 72995 7ff7bc099d84 allocator ProcessCodePage UnDecorator::getVbTableType 72994->72995 72996 7ff7bc099e35 72995->72996 72997 7ff7bc099e97 72995->72997 72999 7ff7bc093c10 shared_ptr 47 API calls 72996->72999 73001 7ff7bc0910b0 51 API calls 72997->73001 73014 7ff7bc099ecb allocator ProcessCodePage UnDecorator::getVbTableType 72997->73014 73000 7ff7bc099c96 72998->73000 73002 7ff7bc099e59 72999->73002 73003 7ff7bc093c10 shared_ptr 47 API calls 73000->73003 73001->73014 73004 7ff7bc093c10 shared_ptr 47 API calls 73002->73004 73003->73008 73009 7ff7bc099e67 73004->73009 73005->72994 73005->72995 73006 7ff7bc099fc0 73012 7ff7bc0910b0 51 API calls 73006->73012 73027 7ff7bc099ff4 allocator ProcessCodePage UnDecorator::getVbTableType 73006->73027 73007 7ff7bc099f5e 73010 7ff7bc093c10 shared_ptr 47 API calls 73007->73010 73011 7ff7bc093c10 shared_ptr 47 API calls 73009->73011 73013 7ff7bc099f82 73010->73013 73015 7ff7bc099e75 73011->73015 73012->73027 73016 7ff7bc093c10 shared_ptr 47 API calls 73013->73016 73014->73006 73014->73007 73017 7ff7bc093c10 shared_ptr 47 API calls 73015->73017 73018 7ff7bc099f90 73016->73018 73021 7ff7bc099e80 73017->73021 73024 7ff7bc093c10 shared_ptr 47 API calls 73018->73024 73019 7ff7bc09a0e6 73025 7ff7bc093c10 shared_ptr 47 API calls 73019->73025 73020 7ff7bc09a087 73022 7ff7bc093c10 shared_ptr 47 API calls 73020->73022 73023 7ff7bc093c10 shared_ptr 47 API calls 73021->73023 73026 7ff7bc09a0ab 73022->73026 73023->73008 73028 7ff7bc099f9e 73024->73028 73029 7ff7bc09a0fb 73025->73029 73030 7ff7bc093c10 shared_ptr 47 API calls 73026->73030 73027->73019 73027->73020 73031 7ff7bc093c10 shared_ptr 47 API calls 73028->73031 73032 7ff7bc093c10 shared_ptr 47 API calls 73029->73032 73033 7ff7bc09a0b9 73030->73033 73034 7ff7bc099fa9 73031->73034 73035 7ff7bc09a109 73032->73035 73036 7ff7bc093c10 shared_ptr 47 API calls 73033->73036 73037 7ff7bc093c10 shared_ptr 47 API calls 73034->73037 73038 7ff7bc093c10 shared_ptr 47 API calls 73035->73038 73040 7ff7bc09a0c7 73036->73040 73037->73008 73039 7ff7bc09a117 73038->73039 73041 7ff7bc093c10 shared_ptr 47 API calls 73039->73041 73042 7ff7bc093c10 shared_ptr 47 API calls 73040->73042 73043 7ff7bc09a122 73041->73043 73044 7ff7bc09a0d2 73042->73044 73045 7ff7bc093c10 shared_ptr 47 API calls 73043->73045 73046 7ff7bc093c10 shared_ptr 47 API calls 73044->73046 73045->73008 73046->73008 73048 7ff7bc0911c7 _Mpunct _WChar_traits shared_ptr 73047->73048 73086 7ff7bc08b440 73048->73086 73050 7ff7bc0911ec 73051 7ff7bc0d98a0 73050->73051 73052 7ff7bc0911a0 _Mpunct 51 API calls 73051->73052 73053 7ff7bc0d98cd 73052->73053 73094 7ff7bc0d8170 73053->73094 73062 7ff7bc093c10 shared_ptr 47 API calls 73063 7ff7bc0d9943 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 73062->73063 73113 7ff7bc0d89d0 73063->73113 73065 7ff7bc0d9a29 Concurrency::details::WorkQueue::IsStructuredEmpty 73126 7ff7bc0904b0 73065->73126 73068 7ff7bc0d997b shared_ptr 73068->73065 73138 7ff7bc0d8200 47 API calls 73068->73138 73139 7ff7bc0d9cd0 51 API calls 2 library calls 73068->73139 73072 7ff7bc0d9a58 73073 7ff7bc093c10 shared_ptr 47 API calls 73072->73073 73074 7ff7bc0d9a66 73073->73074 73075 7ff7bc093c10 shared_ptr 47 API calls 73074->73075 73076 7ff7bc0d9a74 73075->73076 73077 7ff7bc093c10 shared_ptr 47 API calls 73076->73077 73078 7ff7bc0d9a82 73077->73078 73078->72943 73080 7ff7bc0910d2 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::cancellation_token::_FromImpl _aligned_msize 73079->73080 73279 7ff7bc08b8d0 73080->73279 73082 7ff7bc091136 73082->72984 73287 7ff7bc0a2810 73083->73287 73085 7ff7bc093c23 Concurrency::details::HardwareAffinity::operator!= 73085->72989 73087 7ff7bc08b467 _Mpunct 73086->73087 73089 7ff7bc08b473 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error _Mpunct 73087->73089 73092 7ff7bc0a2970 51 API calls Concurrency::task_continuation_context::task_continuation_context 73087->73092 73091 7ff7bc08b4ac type_info::_name_internal_method shared_ptr char_traits 73089->73091 73093 7ff7bc08aff0 49 API calls _Mpunct 73089->73093 73091->73050 73092->73089 73093->73091 73095 7ff7bc0d818f 73094->73095 73097 7ff7bc0d81c7 73095->73097 73140 7ff7bc0d8200 47 API calls 73095->73140 73141 7ff7bc0c6690 51 API calls 73095->73141 73099 7ff7bc093c10 shared_ptr 47 API calls 73097->73099 73100 7ff7bc0d81eb 73099->73100 73101 7ff7bc0d85c0 73100->73101 73102 7ff7bc0d85e9 Concurrency::details::WorkQueue::IsStructuredEmpty 73101->73102 73142 7ff7bc0a2d10 73102->73142 73104 7ff7bc0d8602 73105 7ff7bc0d9e60 73104->73105 73106 7ff7bc0910b0 51 API calls 73105->73106 73109 7ff7bc0d9e90 Concurrency::details::HardwareAffinity::operator!= 73106->73109 73107 7ff7bc093c10 shared_ptr 47 API calls 73108 7ff7bc0d9914 73107->73108 73110 7ff7bc0d8140 73108->73110 73109->73107 73111 7ff7bc0d85c0 type_info::_name_internal_method 51 API calls 73110->73111 73112 7ff7bc0d815d 73111->73112 73112->73062 73147 7ff7bc090f30 73113->73147 73115 7ff7bc0d8ce7 Concurrency::details::HardwareAffinity::operator!= 73116 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73115->73116 73119 7ff7bc0d8d0e 73116->73119 73117 7ff7bc0d8cbf 73117->73115 73153 7ff7bc0d8110 51 API calls Concurrency::task_continuation_context::task_continuation_context 73117->73153 73118 7ff7bc0d89ff 73123 7ff7bc0d8b8e 73118->73123 73151 7ff7bc0d8110 51 API calls Concurrency::task_continuation_context::task_continuation_context 73118->73151 73120 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73119->73120 73122 7ff7bc0d8d19 73120->73122 73122->73068 73123->73115 73123->73117 73152 7ff7bc0d8110 51 API calls Concurrency::task_continuation_context::task_continuation_context 73123->73152 73162 7ff7bc09a5a0 73126->73162 73130 7ff7bc0904d0 73169 7ff7bc0983e0 73130->73169 73133 7ff7bc0904f6 73135 7ff7bc093be0 73133->73135 73274 7ff7bc0a2760 73135->73274 73137 7ff7bc093bf3 Concurrency::details::HardwareAffinity::operator!= 73137->73072 73138->73068 73139->73068 73140->73095 73141->73095 73143 7ff7bc0a2dcf 73142->73143 73145 7ff7bc0a2d4e Concurrency::details::WorkQueue::IsStructuredEmpty type_info::_name_internal_method char_traits 73142->73145 73146 7ff7bc08de60 51 API calls 5 library calls 73143->73146 73145->73104 73146->73145 73148 7ff7bc090f57 _Mpunct shared_ptr char_traits 73147->73148 73154 7ff7bc08b5d0 73148->73154 73150 7ff7bc090f7c 73150->73118 73151->73118 73152->73123 73153->73117 73155 7ff7bc08b5f7 Concurrency::task_continuation_context::task_continuation_context 73154->73155 73157 7ff7bc08b603 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error Concurrency::task_continuation_context::task_continuation_context 73155->73157 73160 7ff7bc0a2970 51 API calls Concurrency::task_continuation_context::task_continuation_context 73155->73160 73159 7ff7bc08b63c type_info::_name_internal_method shared_ptr char_traits 73157->73159 73161 7ff7bc08af90 49 API calls Concurrency::task_continuation_context::task_continuation_context 73157->73161 73159->73150 73160->73157 73161->73159 73186 7ff7bc09a620 73162->73186 73165 7ff7bc0903d0 73166 7ff7bc0903de 73165->73166 73168 7ff7bc09041e UnDecorator::getVbTableType 73166->73168 73204 7ff7bc098370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 73166->73204 73168->73130 73170 7ff7bc0983fb 73169->73170 73171 7ff7bc0904e0 73169->73171 73170->73171 73205 7ff7bc09a8e0 57 API calls 73170->73205 73171->73133 73173 7ff7bc094f80 73171->73173 73174 7ff7bc094fa0 73173->73174 73175 7ff7bc094f96 73173->73175 73177 7ff7bc094ffa 73174->73177 73178 7ff7bc094fbd 73174->73178 73206 7ff7bc09a4a0 73175->73206 73216 7ff7bc099650 RtlPcToFileHeader RaiseException strrchr UnDecorator::getVbTableType 73177->73216 73209 7ff7bc09a510 73178->73209 73183 7ff7bc094fe9 73213 7ff7bc09ae00 73183->73213 73185 7ff7bc094ff7 73185->73133 73187 7ff7bc09a649 73186->73187 73200 7ff7bc09a68b 73186->73200 73202 7ff7bc2a2efc AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive 73187->73202 73201 7ff7bc0904c3 73200->73201 73203 7ff7bc2a2efc AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive 73200->73203 73201->73165 73204->73166 73205->73171 73217 7ff7bc09ebb0 73206->73217 73208 7ff7bc09a4ae MultiByteToWideChar 73208->73174 73218 7ff7bc09aa90 73209->73218 73212 7ff7bc098690 MultiByteToWideChar 73212->73183 73269 7ff7bc09c0d0 73213->73269 73215 7ff7bc09ae1b 73215->73185 73216->73185 73217->73208 73219 7ff7bc09aaa4 73218->73219 73222 7ff7bc09aaae strrchr 73218->73222 73231 7ff7bc098370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 73219->73231 73221 7ff7bc094fcb 73221->73212 73222->73221 73224 7ff7bc09a9c0 73222->73224 73225 7ff7bc09a9d7 strrchr 73224->73225 73226 7ff7bc09aa18 73225->73226 73227 7ff7bc09aa07 73225->73227 73230 7ff7bc09aa15 73226->73230 73240 7ff7bc09ab10 RtlPcToFileHeader RaiseException strrchr UnDecorator::getVbTableType 73226->73240 73232 7ff7bc09a140 73227->73232 73230->73221 73231->73222 73233 7ff7bc09a157 strrchr 73232->73233 73241 7ff7bc097d90 73233->73241 73236 7ff7bc09a1b8 UnDecorator::getVbTableType 73246 7ff7bc0b0d40 73236->73246 73238 7ff7bc09a222 UnDecorator::getVbTableType 73238->73230 73240->73230 73242 7ff7bc097da2 73241->73242 73243 7ff7bc097dca 73242->73243 73262 7ff7bc097f00 HeapAlloc 73242->73262 73243->73236 73245 7ff7bc09ea20 RtlPcToFileHeader RaiseException strrchr 73243->73245 73245->73236 73247 7ff7bc0b0d67 73246->73247 73251 7ff7bc0b0d60 ctype 73246->73251 73248 7ff7bc0b0d90 73247->73248 73252 7ff7bc0b0daa memcpy_s 73247->73252 73263 7ff7bc2a90f0 11 API calls _get_daylight 73248->73263 73250 7ff7bc0b0d95 73264 7ff7bc2a8f84 47 API calls _invalid_parameter_noinfo_noreturn 73250->73264 73251->73238 73252->73251 73254 7ff7bc0b0dfd 73252->73254 73256 7ff7bc0b0e14 73252->73256 73265 7ff7bc2a90f0 11 API calls _get_daylight 73254->73265 73256->73251 73267 7ff7bc2a90f0 11 API calls _get_daylight 73256->73267 73257 7ff7bc0b0e02 73266 7ff7bc2a8f84 47 API calls _invalid_parameter_noinfo_noreturn 73257->73266 73260 7ff7bc0b0e46 73268 7ff7bc2a8f84 47 API calls _invalid_parameter_noinfo_noreturn 73260->73268 73262->73243 73263->73250 73264->73251 73265->73257 73266->73251 73267->73260 73268->73251 73270 7ff7bc09c0e4 strrchr 73269->73270 73272 7ff7bc09c101 strrchr 73270->73272 73273 7ff7bc098370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 73270->73273 73272->73215 73273->73272 73275 7ff7bc0a277d Concurrency::details::WorkQueue::IsStructuredEmpty shared_ptr 73274->73275 73277 7ff7bc0a27b9 shared_ptr char_traits 73275->73277 73278 7ff7bc09f380 47 API calls shared_ptr 73275->73278 73277->73137 73278->73277 73280 7ff7bc08b8f7 _Mpunct 73279->73280 73282 7ff7bc08b906 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error _Mpunct 73280->73282 73285 7ff7bc0a2970 51 API calls Concurrency::task_continuation_context::task_continuation_context 73280->73285 73284 7ff7bc08b942 type_info::_name_internal_method shared_ptr 73282->73284 73286 7ff7bc08aff0 49 API calls _Mpunct 73282->73286 73284->73082 73285->73282 73286->73284 73288 7ff7bc0a282d Concurrency::details::WorkQueue::IsStructuredEmpty shared_ptr 73287->73288 73290 7ff7bc0a2869 shared_ptr char_traits 73288->73290 73291 7ff7bc09f3c0 47 API calls shared_ptr 73288->73291 73290->73085 73291->73290 73292 7ff7bc09c290 73293 7ff7bc09c2a8 ctype 73292->73293 73619 7ff7bc0aa0d0 73293->73619 73295 7ff7bc09c2b8 73696 7ff7bc0ad500 73295->73696 73298 7ff7bc0911a0 _Mpunct 51 API calls 73299 7ff7bc09c2ef 73298->73299 73300 7ff7bc0d98a0 71 API calls 73299->73300 73301 7ff7bc09c309 73300->73301 73302 7ff7bc0911a0 _Mpunct 51 API calls 73301->73302 73303 7ff7bc09c32e 73302->73303 73304 7ff7bc0d98a0 71 API calls 73303->73304 73305 7ff7bc09c348 73304->73305 73306 7ff7bc0911a0 _Mpunct 51 API calls 73305->73306 73307 7ff7bc09c36d 73306->73307 73308 7ff7bc0d98a0 71 API calls 73307->73308 73309 7ff7bc09c387 73308->73309 73310 7ff7bc0911a0 _Mpunct 51 API calls 73309->73310 73311 7ff7bc09c3ac 73310->73311 73312 7ff7bc0d98a0 71 API calls 73311->73312 73313 7ff7bc09c3c6 73312->73313 73314 7ff7bc0911a0 _Mpunct 51 API calls 73313->73314 73315 7ff7bc09c3eb 73314->73315 73316 7ff7bc0d98a0 71 API calls 73315->73316 73317 7ff7bc09c405 73316->73317 73318 7ff7bc0911a0 _Mpunct 51 API calls 73317->73318 73319 7ff7bc09c42a 73318->73319 73320 7ff7bc0d98a0 71 API calls 73319->73320 73321 7ff7bc09c447 allocator 73320->73321 73322 7ff7bc0911a0 _Mpunct 51 API calls 73321->73322 73323 7ff7bc09c47c UnDecorator::getVbTableType 73322->73323 73324 7ff7bc0911a0 _Mpunct 51 API calls 73323->73324 73325 7ff7bc09c4af 73324->73325 73326 7ff7bc0d98a0 71 API calls 73325->73326 73327 7ff7bc09c4c9 73326->73327 73720 7ff7bc0905d0 73327->73720 73331 7ff7bc09c4e2 allocator 73741 7ff7bc09a250 73331->73741 73333 7ff7bc09c54c UnDecorator::getVbTableType 73744 7ff7bc090510 73333->73744 73336 7ff7bc090510 67 API calls 73337 7ff7bc09c584 73336->73337 73753 7ff7bc090450 73337->73753 73620 7ff7bc0a62c0 74 API calls 73619->73620 73621 7ff7bc0aa0e9 73620->73621 73622 7ff7bc0911a0 _Mpunct 51 API calls 73621->73622 73695 7ff7bc0aa6b2 UnDecorator::getVbTableType 73621->73695 73623 7ff7bc0aa11c 73622->73623 73624 7ff7bc0d98a0 71 API calls 73623->73624 73625 7ff7bc0aa136 73624->73625 73626 7ff7bc0911a0 _Mpunct 51 API calls 73625->73626 73627 7ff7bc0aa15b 73626->73627 73628 7ff7bc0d98a0 71 API calls 73627->73628 73629 7ff7bc0aa175 73628->73629 73630 7ff7bc0905d0 59 API calls 73629->73630 73631 7ff7bc0aa180 73630->73631 73632 7ff7bc0905d0 59 API calls 73631->73632 73633 7ff7bc0aa18b 73632->73633 73634 7ff7bc0aa1ab 73633->73634 73635 7ff7bc0aa19b 73633->73635 73638 7ff7bc0911a0 _Mpunct 51 API calls 73634->73638 73636 7ff7bc0aa1a6 73635->73636 73637 7ff7bc0aa22a 73635->73637 73642 7ff7bc0905d0 59 API calls 73636->73642 73639 7ff7bc0911a0 _Mpunct 51 API calls 73637->73639 73640 7ff7bc0aa1cf 73638->73640 73641 7ff7bc0aa24e 73639->73641 73643 7ff7bc0d98a0 71 API calls 73640->73643 73644 7ff7bc0d98a0 71 API calls 73641->73644 73645 7ff7bc0aa2b3 73642->73645 73646 7ff7bc0aa1ec 73643->73646 73649 7ff7bc0aa26b 73644->73649 73647 7ff7bc0911a0 _Mpunct 51 API calls 73645->73647 74656 7ff7bc094f50 73646->74656 73650 7ff7bc0aa2d8 73647->73650 73651 7ff7bc094f50 UnDecorator::getVbTableType 50 API calls 73649->73651 73652 7ff7bc0d98a0 71 API calls 73650->73652 73655 7ff7bc0aa216 UnDecorator::getVbTableType 73651->73655 73653 7ff7bc0aa2f5 73652->73653 73654 7ff7bc094f50 UnDecorator::getVbTableType 50 API calls 73653->73654 73656 7ff7bc0aa31f UnDecorator::getVbTableType 73654->73656 73657 7ff7bc0911a0 _Mpunct 51 API calls 73655->73657 73661 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73656->73661 73658 7ff7bc0aa46f 73657->73658 73659 7ff7bc0d98a0 71 API calls 73658->73659 73660 7ff7bc0aa489 73659->73660 73662 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73660->73662 73663 7ff7bc0aa350 73661->73663 73664 7ff7bc0aa4ac 73662->73664 73665 7ff7bc0d8e90 71 API calls 73663->73665 73666 7ff7bc0d8e90 71 API calls 73664->73666 73667 7ff7bc0aa36d allocator 73665->73667 73668 7ff7bc0aa4c9 73666->73668 73671 7ff7bc09a250 69 API calls 73667->73671 73669 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73668->73669 73670 7ff7bc0aa516 73669->73670 73672 7ff7bc0d8e90 71 API calls 73670->73672 73674 7ff7bc0aa3a4 allocator UnDecorator::getVbTableType 73671->73674 73673 7ff7bc0aa533 allocator 73672->73673 73675 7ff7bc09a250 69 API calls 73673->73675 73676 7ff7bc0911a0 _Mpunct 51 API calls 73674->73676 73679 7ff7bc0aa57a UnDecorator::getVbTableType 73675->73679 73677 7ff7bc0aa3dd 73676->73677 73678 7ff7bc0d98a0 71 API calls 73677->73678 73680 7ff7bc0aa3fa 73678->73680 73682 7ff7bc090510 67 API calls 73679->73682 73681 7ff7bc094f50 UnDecorator::getVbTableType 50 API calls 73680->73681 73681->73655 73683 7ff7bc0aa5a8 73682->73683 73684 7ff7bc090510 67 API calls 73683->73684 73685 7ff7bc0aa5ba 73684->73685 73686 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73685->73686 73687 7ff7bc0aa5dd 73686->73687 73688 7ff7bc0d8e90 71 API calls 73687->73688 73689 7ff7bc0aa5fa 73688->73689 73690 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73689->73690 73691 7ff7bc0aa644 73690->73691 73692 7ff7bc0d8e90 71 API calls 73691->73692 73693 7ff7bc0aa661 73692->73693 73694 7ff7bc11ca30 76 API calls 73693->73694 73694->73695 73695->73295 73697 7ff7bc0911a0 _Mpunct 51 API calls 73696->73697 73698 7ff7bc0ad52e 73697->73698 73699 7ff7bc0d98a0 71 API calls 73698->73699 73700 7ff7bc0ad542 allocator 73699->73700 73701 7ff7bc0911a0 _Mpunct 51 API calls 73700->73701 73702 7ff7bc0ad56b UnDecorator::getVbTableType 73701->73702 73703 7ff7bc0911a0 _Mpunct 51 API calls 73702->73703 73704 7ff7bc0ad595 73703->73704 73705 7ff7bc0d98a0 71 API calls 73704->73705 73706 7ff7bc0ad5b2 allocator 73705->73706 73707 7ff7bc0911a0 _Mpunct 51 API calls 73706->73707 73708 7ff7bc0ad5e7 UnDecorator::getVbTableType 73707->73708 73709 7ff7bc0ad5f5 GetModuleFileNameW 73708->73709 73710 7ff7bc0910b0 51 API calls 73709->73710 73711 7ff7bc0ad632 allocator 73710->73711 73712 7ff7bc0ad664 RegOpenKeyExW 73711->73712 73713 7ff7bc0ad698 UnDecorator::getVbTableType 73712->73713 73714 7ff7bc0ad6a0 RegSetValueExW RegCloseKey 73713->73714 73715 7ff7bc0ad705 73713->73715 73714->73715 73716 7ff7bc093c10 shared_ptr 47 API calls 73715->73716 73717 7ff7bc0ad712 73716->73717 73718 7ff7bc093c10 shared_ptr 47 API calls 73717->73718 73719 7ff7bc09c2ca 73718->73719 73719->73298 73721 7ff7bc09a5a0 57 API calls 73720->73721 73722 7ff7bc0905de 73721->73722 73723 7ff7bc0903d0 2 API calls 73722->73723 73724 7ff7bc0905eb 73723->73724 73725 7ff7bc0fa6b0 73724->73725 73726 7ff7bc0905d0 59 API calls 73725->73726 73727 7ff7bc0fa6ce 73726->73727 74674 7ff7bc09a530 73727->74674 73730 7ff7bc0fa796 73732 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73730->73732 73731 7ff7bc0fa70b 73733 7ff7bc0911a0 _Mpunct 51 API calls 73731->73733 73734 7ff7bc0fa76b UnDecorator::getVbTableType 73732->73734 73735 7ff7bc0fa726 73733->73735 73734->73331 73736 7ff7bc0d98a0 71 API calls 73735->73736 73737 7ff7bc0fa73a 73736->73737 73738 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73737->73738 73739 7ff7bc0fa754 73738->73739 73740 7ff7bc0d8e90 71 API calls 73739->73740 73740->73734 74678 7ff7bc09a320 73741->74678 73743 7ff7bc09a286 73743->73333 73745 7ff7bc09a5a0 57 API calls 73744->73745 73746 7ff7bc090523 73745->73746 73747 7ff7bc0903d0 2 API calls 73746->73747 73748 7ff7bc090530 73747->73748 73749 7ff7bc0983e0 57 API calls 73748->73749 73750 7ff7bc090540 73749->73750 73752 7ff7bc090556 73750->73752 74776 7ff7bc095010 50 API calls UnDecorator::getVbTableType 73750->74776 73752->73336 74777 7ff7bc090380 73753->74777 73755 7ff7bc09046d 73756 7ff7bc0d8e90 73755->73756 73757 7ff7bc0d8eb6 allocator 73756->73757 73758 7ff7bc0911a0 _Mpunct 51 API calls 73757->73758 73759 7ff7bc0d8ec6 73758->73759 73760 7ff7bc093c10 shared_ptr 47 API calls 73759->73760 73763 7ff7bc0d8eea shared_ptr 73760->73763 73762 7ff7bc0d8fab 73764 7ff7bc0d8fbc 73762->73764 73770 7ff7bc0d9007 shared_ptr 73762->73770 74781 7ff7bc0d8610 73763->74781 73765 7ff7bc0905d0 59 API calls 73764->73765 73766 7ff7bc0d8fc9 73765->73766 74793 7ff7bc0d7fa0 73766->74793 73769 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 74796 7ff7bc0897a0 51 API calls 4 library calls 73770->74796 73772 7ff7bc0d909d shared_ptr 74797 7ff7bc0897a0 51 API calls 4 library calls 73772->74797 73774 7ff7bc0d9152 73775 7ff7bc0d9e60 51 API calls 73774->73775 73776 7ff7bc0d9170 Concurrency::details::WorkQueue::IsStructuredEmpty 73775->73776 73777 7ff7bc090510 67 API calls 73776->73777 74659 7ff7bc094e50 74656->74659 74658 7ff7bc094f6d 74658->73655 74660 7ff7bc094e68 strrchr UnDecorator::getVbTableType 74659->74660 74661 7ff7bc094ee3 74660->74661 74663 7ff7bc094eaf allocator std::ios_base::good 74660->74663 74665 7ff7bc094ee0 UnDecorator::getVbTableType 74660->74665 74667 7ff7bc098440 74661->74667 74666 7ff7bc09c180 50 API calls 4 library calls 74663->74666 74665->74658 74666->74665 74668 7ff7bc098468 UnDecorator::getVbTableType 74667->74668 74670 7ff7bc0984e0 UnDecorator::getVbTableType 74668->74670 74672 7ff7bc09848d UnDecorator::getVbTableType 74668->74672 74673 7ff7bc09ea20 RtlPcToFileHeader RaiseException strrchr 74668->74673 74671 7ff7bc0b0d40 UnDecorator::getVbTableType 47 API calls 74670->74671 74671->74672 74672->74665 74673->74670 74675 7ff7bc09a543 strrchr 74674->74675 74676 7ff7bc09a56b GetUserDefaultUILanguage LCIDToLocaleName 74675->74676 74677 7ff7bc09a140 strrchr 50 API calls 74675->74677 74676->73730 74676->73731 74677->74676 74679 7ff7bc09a345 74678->74679 74680 7ff7bc09a33b 74678->74680 74696 7ff7bc09a5b0 74679->74696 74715 7ff7bc098370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 74680->74715 74686 7ff7bc09a36a 74700 7ff7bc09a780 74686->74700 74690 7ff7bc09a510 strrchr 50 API calls 74691 7ff7bc09a396 allocator 74690->74691 74711 7ff7bc09a2a0 74691->74711 74694 7ff7bc09ae00 UnDecorator::getVbTableType 2 API calls 74695 7ff7bc09a3d1 UnDecorator::getVbTableType 74694->74695 74695->73743 74697 7ff7bc09a5c3 _vswprintf_s_l 74696->74697 74717 7ff7bc2af358 74697->74717 74702 7ff7bc09a793 74700->74702 74701 7ff7bc09a375 74704 7ff7bc090570 74701->74704 74702->74701 74703 7ff7bc09a5a0 57 API calls 74702->74703 74703->74701 74705 7ff7bc0903d0 2 API calls 74704->74705 74706 7ff7bc090592 74705->74706 74707 7ff7bc0983e0 57 API calls 74706->74707 74708 7ff7bc0905a2 74707->74708 74709 7ff7bc0905b8 74708->74709 74761 7ff7bc095010 50 API calls UnDecorator::getVbTableType 74708->74761 74709->74690 74712 7ff7bc09a2bd _vswprintf_s_l 74711->74712 74762 7ff7bc2af5b4 74712->74762 74715->74679 74716 7ff7bc098370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 74716->74686 74718 7ff7bc2af3b2 74717->74718 74719 7ff7bc2af3d7 74718->74719 74721 7ff7bc2af413 74718->74721 74748 7ff7bc2a8eb8 47 API calls 2 library calls 74719->74748 74749 7ff7bc2acdb4 50 API calls _vswprintf_s_l 74721->74749 74723 7ff7bc2af401 74724 7ff7bc2af575 74723->74724 74756 7ff7bc2a8b98 47 API calls 2 library calls 74723->74756 74731 7ff7bc2af58b 74724->74731 74757 7ff7bc2a8b98 47 API calls 2 library calls 74724->74757 74725 7ff7bc2af4ae 74730 7ff7bc2af4f4 74725->74730 74733 7ff7bc2af4c9 74725->74733 74734 7ff7bc2af51a 74725->74734 74735 7ff7bc2af4c0 74725->74735 74727 7ff7bc2c0dd4 __free_lconv_num 11 API calls 74727->74723 74730->74727 74739 7ff7bc2a31a0 74731->74739 74750 7ff7bc2c0dd4 74733->74750 74734->74730 74736 7ff7bc2af524 74734->74736 74735->74730 74735->74733 74738 7ff7bc2c0dd4 __free_lconv_num 11 API calls 74736->74738 74738->74723 74740 7ff7bc2a31a9 74739->74740 74741 7ff7bc2a39c4 IsProcessorFeaturePresent 74740->74741 74742 7ff7bc09a355 74740->74742 74743 7ff7bc2a39dc 74741->74743 74742->74686 74742->74716 74758 7ff7bc2a3bbc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 74743->74758 74745 7ff7bc2a39ef 74759 7ff7bc2a3990 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 74745->74759 74748->74723 74749->74725 74751 7ff7bc2c0e0a 74750->74751 74752 7ff7bc2c0dd9 HeapFree 74750->74752 74751->74723 74752->74751 74753 7ff7bc2c0df4 GetLastError 74752->74753 74754 7ff7bc2c0e01 __free_lconv_num 74753->74754 74760 7ff7bc2a90f0 11 API calls _get_daylight 74754->74760 74756->74724 74757->74731 74758->74745 74760->74751 74761->74709 74763 7ff7bc2af5ed 74762->74763 74764 7ff7bc2af630 74763->74764 74772 7ff7bc2a9cdc 50 API calls 3 library calls 74763->74772 74767 7ff7bc2af66f 74764->74767 74773 7ff7bc2a8eb8 47 API calls 2 library calls 74764->74773 74768 7ff7bc2af695 74767->74768 74774 7ff7bc2a8b98 47 API calls 2 library calls 74767->74774 74769 7ff7bc09a2ee 74768->74769 74775 7ff7bc2a8b98 47 API calls 2 library calls 74768->74775 74769->74694 74772->74764 74773->74767 74774->74768 74775->74769 74776->73752 74778 7ff7bc090398 strrchr 74777->74778 74779 7ff7bc098440 UnDecorator::getVbTableType 49 API calls 74778->74779 74780 7ff7bc0903a7 UnDecorator::getVbTableType 74779->74780 74780->73755 74782 7ff7bc090f30 _Mpunct 51 API calls 74781->74782 74792 7ff7bc0d863a Concurrency::details::HardwareAffinity::operator!= 74782->74792 74783 7ff7bc0d8981 74784 7ff7bc0d7fa0 47 API calls 74783->74784 74785 7ff7bc0d89a8 74784->74785 74786 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 74785->74786 74789 7ff7bc0d89b3 74786->74789 74787 7ff7bc0d8838 74787->74783 74800 7ff7bc0d9e00 51 API calls 74787->74800 74789->73762 74792->74787 74798 7ff7bc0d9d60 50 API calls 74792->74798 74799 7ff7bc0d9e00 51 API calls 74792->74799 74801 7ff7bc0d84f0 74793->74801 74796->73772 74797->73774 74798->74792 74799->74792 74800->74787 74803 7ff7bc0d8503 Concurrency::details::WorkQueue::IsStructuredEmpty shared_ptr 74801->74803 74802 7ff7bc0d7fb3 74802->73769 74803->74802 74805 7ff7bc0a4850 47 API calls type_info::_name_internal_method 74803->74805 74805->74802 77023 7ff7bc08d5f0 77024 7ff7bc08d608 allocator _aligned_msize type_info::_name_internal_method shared_ptr 77023->77024 77029 7ff7bc08fba0 77024->77029 77028 7ff7bc08d659 77034 7ff7bc09b130 77029->77034 77109 7ff7bc09afb0 77029->77109 77030 7ff7bc08d654 77033 7ff7bc281a54 60 API calls std::_Throw_Cpp_error 77030->77033 77033->77028 77035 7ff7bc0911a0 _Mpunct 51 API calls 77034->77035 77036 7ff7bc09b161 77035->77036 77037 7ff7bc0d98a0 71 API calls 77036->77037 77038 7ff7bc09b17b 77037->77038 77039 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77038->77039 77040 7ff7bc09b1e0 77039->77040 77041 7ff7bc0d8e90 71 API calls 77040->77041 77042 7ff7bc09b1fd allocator UnDecorator::getVbTableType 77041->77042 77043 7ff7bc09b227 RegisterClassExW 77042->77043 77044 7ff7bc09b24d 77043->77044 77052 7ff7bc09b23d UnDecorator::getVbTableType 77043->77052 77045 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77044->77045 77046 7ff7bc09b283 77045->77046 77047 7ff7bc0d8e90 71 API calls 77046->77047 77048 7ff7bc09b2a0 allocator 77047->77048 77049 7ff7bc09b2b5 CreateWindowExW 77048->77049 77050 7ff7bc09b33a UnDecorator::getVbTableType 77049->77050 77051 7ff7bc09b35a ShowWindow 77050->77051 77050->77052 77053 7ff7bc09b384 77051->77053 77052->77030 77054 7ff7bc0ac710 51 API calls 77053->77054 77055 7ff7bc09b3bb 77054->77055 77056 7ff7bc0ac1b0 51 API calls 77055->77056 77057 7ff7bc09b3cd 77056->77057 77058 7ff7bc0911a0 _Mpunct 51 API calls 77057->77058 77059 7ff7bc09b40b 77058->77059 77060 7ff7bc0d98a0 71 API calls 77059->77060 77061 7ff7bc09b428 77060->77061 77062 7ff7bc0911a0 _Mpunct 51 API calls 77061->77062 77063 7ff7bc09b44d 77062->77063 77064 7ff7bc0d98a0 71 API calls 77063->77064 77065 7ff7bc09b46a 77064->77065 77066 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77065->77066 77067 7ff7bc09b490 77066->77067 77068 7ff7bc0d8e90 71 API calls 77067->77068 77069 7ff7bc09b4ad 77068->77069 77070 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77069->77070 77071 7ff7bc09b4fa 77070->77071 77072 7ff7bc0d8e90 71 API calls 77071->77072 77073 7ff7bc09b517 77072->77073 77128 7ff7bc095950 77073->77128 77075 7ff7bc09b54b 77137 7ff7bc095880 77075->77137 77077 7ff7bc09b590 allocator UnDecorator::getVbTableType 77078 7ff7bc0950c0 task 51 API calls 77077->77078 77082 7ff7bc09bfd8 UnDecorator::getVbTableType 77077->77082 77090 7ff7bc09be5e OpenEventW 77077->77090 77092 7ff7bc09be49 77077->77092 77096 7ff7bc0911a0 51 API calls _Mpunct 77077->77096 77097 7ff7bc090510 67 API calls 77077->77097 77101 7ff7bc0d8e90 71 API calls 77077->77101 77104 7ff7bc090450 49 API calls Concurrency::details::SchedulerBase::GetPolicy 77077->77104 77105 7ff7bc11d350 89 API calls 77077->77105 77106 7ff7bc0ad500 75 API calls 77077->77106 77107 7ff7bc0d98a0 71 API calls 77077->77107 77108 7ff7bc0a3b30 107 API calls 77077->77108 77146 7ff7bc115130 keybd_event keybd_event 77077->77146 77147 7ff7bc0fab70 53 API calls 2 library calls 77077->77147 77079 7ff7bc09b5e7 GetForegroundWindow 77078->77079 77081 7ff7bc09b62f Concurrency::details::WorkQueue::IsStructuredEmpty 77079->77081 77080 7ff7bc09b602 GetWindowTextW 77080->77081 77081->77080 77083 7ff7bc09b662 PeekMessageW 77081->77083 77086 7ff7bc093c10 shared_ptr 47 API calls 77082->77086 77084 7ff7bc09b692 TranslateMessage DispatchMessageW 77083->77084 77085 7ff7bc09be21 Sleep 77083->77085 77084->77077 77085->77077 77087 7ff7bc09c021 77086->77087 77088 7ff7bc093c10 shared_ptr 47 API calls 77087->77088 77088->77052 77090->77077 77091 7ff7bc09be82 WaitForSingleObject 77090->77091 77091->77077 77099 7ff7bc09be9a allocator UnDecorator::getVbTableType 77091->77099 77092->77077 77094 7ff7bc0911a0 51 API calls _Mpunct 77094->77099 77095 7ff7bc0d98a0 71 API calls 77095->77099 77096->77077 77097->77077 77098 7ff7bc0910b0 51 API calls 77098->77099 77099->77094 77099->77095 77099->77098 77100 7ff7bc12db90 81 API calls 77099->77100 77102 7ff7bc09bfb8 CloseHandle 77100->77102 77101->77077 77103 7ff7bc093c10 shared_ptr 47 API calls 77102->77103 77103->77092 77104->77077 77105->77077 77106->77077 77107->77077 77108->77077 77110 7ff7bc0911a0 _Mpunct 51 API calls 77109->77110 77111 7ff7bc09afda 77110->77111 77112 7ff7bc0d98a0 71 API calls 77111->77112 77113 7ff7bc09afee allocator 77112->77113 77114 7ff7bc0911a0 _Mpunct 51 API calls 77113->77114 77115 7ff7bc09b014 UnDecorator::getVbTableType 77114->77115 77116 7ff7bc0910b0 51 API calls 77115->77116 77117 7ff7bc09b03c allocator 77116->77117 77118 7ff7bc09b05f OpenEventW 77117->77118 77120 7ff7bc09b07e UnDecorator::getVbTableType 77118->77120 77160 7ff7bc25f160 77120->77160 77377 7ff7bc260140 77120->77377 77123 7ff7bc09b0a8 77124 7ff7bc09b0b0 CloseHandle 77123->77124 77125 7ff7bc09b0bc 77123->77125 77124->77125 77126 7ff7bc093c10 shared_ptr 47 API calls 77125->77126 77127 7ff7bc09b0c6 77126->77127 77127->77030 77129 7ff7bc09a780 57 API calls 77128->77129 77130 7ff7bc095975 77129->77130 77148 7ff7bc090480 77130->77148 77132 7ff7bc095982 allocator std::ios_base::good UnDecorator::getVbTableType 77151 7ff7bc0985e0 77132->77151 77135 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77136 7ff7bc0959de UnDecorator::getVbTableType 77135->77136 77136->77075 77138 7ff7bc09a780 57 API calls 77137->77138 77139 7ff7bc0958a5 77138->77139 77140 7ff7bc090480 2 API calls 77139->77140 77141 7ff7bc0958b2 allocator std::ios_base::good 77140->77141 77142 7ff7bc0985e0 50 API calls 77141->77142 77143 7ff7bc095914 77142->77143 77144 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77143->77144 77145 7ff7bc095923 UnDecorator::getVbTableType 77144->77145 77145->77077 77146->77092 77147->77077 77149 7ff7bc0903d0 2 API calls 77148->77149 77150 7ff7bc09049d 77149->77150 77150->77132 77152 7ff7bc09a510 strrchr 50 API calls 77151->77152 77153 7ff7bc098616 77152->77153 77154 7ff7bc0b0d40 UnDecorator::getVbTableType 47 API calls 77153->77154 77155 7ff7bc098640 77154->77155 77156 7ff7bc0b0d40 UnDecorator::getVbTableType 47 API calls 77155->77156 77157 7ff7bc09867b 77156->77157 77158 7ff7bc09ae00 UnDecorator::getVbTableType 2 API calls 77157->77158 77159 7ff7bc0959cf 77158->77159 77159->77135 77161 7ff7bc090f30 _Mpunct 51 API calls 77160->77161 77162 7ff7bc25f18e 77161->77162 77594 7ff7bc0d9aa0 77162->77594 77165 7ff7bc090f30 _Mpunct 51 API calls 77166 7ff7bc25f1d0 77165->77166 77167 7ff7bc0d9aa0 88 API calls 77166->77167 77168 7ff7bc25f1ed 77167->77168 77169 7ff7bc090f30 _Mpunct 51 API calls 77168->77169 77170 7ff7bc25f212 77169->77170 77171 7ff7bc0d9aa0 88 API calls 77170->77171 77172 7ff7bc25f22f 77171->77172 77173 7ff7bc090f30 _Mpunct 51 API calls 77172->77173 77174 7ff7bc25f254 77173->77174 77175 7ff7bc0d9aa0 88 API calls 77174->77175 77176 7ff7bc25f271 77175->77176 77177 7ff7bc090f30 _Mpunct 51 API calls 77176->77177 77178 7ff7bc25f296 77177->77178 77179 7ff7bc0d9aa0 88 API calls 77178->77179 77180 7ff7bc25f2b3 77179->77180 77624 7ff7bc090e90 77180->77624 77191 7ff7bc0b9140 shared_ptr 47 API calls 77192 7ff7bc25f39b 77191->77192 77193 7ff7bc0b9140 shared_ptr 47 API calls 77192->77193 77194 7ff7bc25f3a9 77193->77194 77195 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77194->77195 77196 7ff7bc25f3b7 77195->77196 77679 7ff7bc267830 77196->77679 77199 7ff7bc090e90 std::_Throw_Cpp_error 51 API calls 77200 7ff7bc25f3fe 77199->77200 77201 7ff7bc0d9580 54 API calls 77200->77201 77202 7ff7bc25f41b 77201->77202 77203 7ff7bc11f8f0 54 API calls 77202->77203 77204 7ff7bc25f44b 77203->77204 77205 7ff7bc1188f0 51 API calls 77204->77205 77206 7ff7bc25f469 77205->77206 77717 7ff7bc10bf80 77206->77717 77378 7ff7bc090f30 _Mpunct 51 API calls 77377->77378 77379 7ff7bc26016e 77378->77379 77380 7ff7bc0d9aa0 88 API calls 77379->77380 77381 7ff7bc26018b 77380->77381 77382 7ff7bc090f30 _Mpunct 51 API calls 77381->77382 77383 7ff7bc2601b0 77382->77383 77384 7ff7bc0d9aa0 88 API calls 77383->77384 77385 7ff7bc2601cd 77384->77385 77386 7ff7bc090f30 _Mpunct 51 API calls 77385->77386 77387 7ff7bc2601f2 77386->77387 77388 7ff7bc0d9aa0 88 API calls 77387->77388 77389 7ff7bc26020f 77388->77389 77390 7ff7bc090f30 _Mpunct 51 API calls 77389->77390 77391 7ff7bc260234 77390->77391 77392 7ff7bc0d9aa0 88 API calls 77391->77392 77393 7ff7bc260251 77392->77393 77394 7ff7bc090f30 _Mpunct 51 API calls 77393->77394 77395 7ff7bc260276 77394->77395 77396 7ff7bc0d9aa0 88 API calls 77395->77396 77397 7ff7bc260293 77396->77397 77398 7ff7bc090e90 std::_Throw_Cpp_error 51 API calls 77397->77398 77399 7ff7bc2602b9 77398->77399 77400 7ff7bc0d9580 54 API calls 77399->77400 77401 7ff7bc2602d6 77400->77401 77402 7ff7bc11f8f0 54 API calls 77401->77402 77403 7ff7bc260306 77402->77403 77404 7ff7bc25caf0 52 API calls 77403->77404 77405 7ff7bc260338 77404->77405 77406 7ff7bc1188f0 51 API calls 77405->77406 77407 7ff7bc26036d 77406->77407 77408 7ff7bc0b9140 shared_ptr 47 API calls 77407->77408 77409 7ff7bc26037b 77408->77409 77410 7ff7bc0b9140 shared_ptr 47 API calls 77409->77410 77411 7ff7bc260389 77410->77411 77412 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77411->77412 77413 7ff7bc260397 77412->77413 77414 7ff7bc267830 125 API calls 77413->77414 77415 7ff7bc2603b8 77414->77415 77416 7ff7bc090e90 std::_Throw_Cpp_error 51 API calls 77415->77416 77417 7ff7bc2603de 77416->77417 77418 7ff7bc0d9580 54 API calls 77417->77418 77419 7ff7bc2603fb 77418->77419 77420 7ff7bc11f8f0 54 API calls 77419->77420 77421 7ff7bc26042b 77420->77421 77422 7ff7bc1188f0 51 API calls 77421->77422 77423 7ff7bc260449 77422->77423 77424 7ff7bc10bf80 75 API calls 77423->77424 77425 7ff7bc26046e 77424->77425 77426 7ff7bc0b9140 shared_ptr 47 API calls 77425->77426 77427 7ff7bc26047f 77426->77427 77428 7ff7bc0b9140 shared_ptr 47 API calls 77427->77428 77429 7ff7bc26048d 77428->77429 77430 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77429->77430 77431 7ff7bc26049b 77430->77431 77432 7ff7bc26058f 77431->77432 77434 7ff7bc090e90 std::_Throw_Cpp_error 51 API calls 77431->77434 77433 7ff7bc090e90 std::_Throw_Cpp_error 51 API calls 77432->77433 77436 7ff7bc2605b5 77433->77436 77435 7ff7bc2604cd 77434->77435 77437 7ff7bc0d9580 54 API calls 77435->77437 77438 7ff7bc0d9580 54 API calls 77436->77438 77439 7ff7bc2604ea 77437->77439 77440 7ff7bc2605d2 77438->77440 77441 7ff7bc11f8f0 54 API calls 77439->77441 77442 7ff7bc11f8f0 54 API calls 77440->77442 77443 7ff7bc26051a 77441->77443 77444 7ff7bc260602 77442->77444 77445 7ff7bc1188f0 51 API calls 77443->77445 77446 7ff7bc1188f0 51 API calls 77444->77446 77447 7ff7bc260538 77445->77447 77448 7ff7bc260620 77446->77448 78328 7ff7bc267d20 51 API calls shared_ptr 77447->78328 77450 7ff7bc10bf80 75 API calls 77448->77450 77452 7ff7bc260645 77450->77452 77451 7ff7bc260565 77453 7ff7bc0b9140 shared_ptr 47 API calls 77451->77453 77454 7ff7bc0b9140 shared_ptr 47 API calls 77452->77454 77455 7ff7bc260573 77453->77455 77456 7ff7bc260656 77454->77456 77457 7ff7bc0b9140 shared_ptr 47 API calls 77455->77457 77458 7ff7bc0b9140 shared_ptr 47 API calls 77456->77458 77459 7ff7bc260581 77457->77459 77460 7ff7bc260664 77458->77460 77461 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77459->77461 77462 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77460->77462 77461->77432 77463 7ff7bc260672 77462->77463 77464 7ff7bc090e90 std::_Throw_Cpp_error 51 API calls 77463->77464 77470 7ff7bc260766 HandleT Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 77463->77470 77465 7ff7bc2606a4 77464->77465 77466 7ff7bc0d9580 54 API calls 77465->77466 77467 7ff7bc2606c1 77466->77467 77468 7ff7bc11f8f0 54 API calls 77467->77468 77469 7ff7bc2606f1 77468->77469 77472 7ff7bc1188f0 51 API calls 77469->77472 77471 7ff7bc260a6d 77470->77471 77473 7ff7bc090e90 std::_Throw_Cpp_error 51 API calls 77470->77473 77479 7ff7bc0911a0 _Mpunct 51 API calls 77471->77479 77593 7ff7bc26104d UnDecorator::getVbTableType 77471->77593 77474 7ff7bc26070f 77472->77474 77475 7ff7bc2607e7 77473->77475 78329 7ff7bc267d20 51 API calls shared_ptr 77474->78329 77477 7ff7bc0d9580 54 API calls 77475->77477 77481 7ff7bc260804 77477->77481 77478 7ff7bc25c450 47 API calls 77482 7ff7bc2610a9 77478->77482 77483 7ff7bc260aac 77479->77483 77480 7ff7bc26073c 77484 7ff7bc0b9140 shared_ptr 47 API calls 77480->77484 77485 7ff7bc11f8f0 54 API calls 77481->77485 77486 7ff7bc25c430 47 API calls 77482->77486 77487 7ff7bc0d98a0 71 API calls 77483->77487 77488 7ff7bc26074a 77484->77488 77489 7ff7bc260834 77485->77489 77490 7ff7bc2610b4 77486->77490 77491 7ff7bc260ac9 77487->77491 77492 7ff7bc0b9140 shared_ptr 47 API calls 77488->77492 77493 7ff7bc1188f0 51 API calls 77489->77493 77494 7ff7bc0b9140 shared_ptr 47 API calls 77490->77494 77495 7ff7bc0911a0 _Mpunct 51 API calls 77491->77495 77496 7ff7bc260758 77492->77496 77497 7ff7bc26084f 77493->77497 77499 7ff7bc2610c2 77494->77499 77500 7ff7bc260aee 77495->77500 77501 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77496->77501 77498 7ff7bc10bf80 75 API calls 77497->77498 77502 7ff7bc260874 77498->77502 77503 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77499->77503 77504 7ff7bc0d98a0 71 API calls 77500->77504 77501->77470 77506 7ff7bc0b9140 shared_ptr 47 API calls 77502->77506 77507 7ff7bc2610d0 77503->77507 77505 7ff7bc260b0b 77504->77505 77508 7ff7bc0911a0 _Mpunct 51 API calls 77505->77508 77509 7ff7bc260885 77506->77509 77510 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77507->77510 77511 7ff7bc260b30 77508->77511 77512 7ff7bc0b9140 shared_ptr 47 API calls 77509->77512 77513 7ff7bc2610de 77510->77513 77514 7ff7bc0d98a0 71 API calls 77511->77514 77515 7ff7bc260893 77512->77515 77516 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77513->77516 77517 7ff7bc260b4d 77514->77517 77518 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77515->77518 77519 7ff7bc2610ec 77516->77519 77520 7ff7bc0911a0 _Mpunct 51 API calls 77517->77520 77521 7ff7bc2608a1 77518->77521 77522 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77519->77522 77523 7ff7bc260b72 77520->77523 77521->77471 77527 7ff7bc090e90 std::_Throw_Cpp_error 51 API calls 77521->77527 77524 7ff7bc2610fa 77522->77524 77526 7ff7bc0d98a0 71 API calls 77523->77526 77525 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77524->77525 77528 7ff7bc09b089 WaitForSingleObject 77525->77528 77532 7ff7bc260b8f 77526->77532 77529 7ff7bc2608d3 77527->77529 77528->77120 77528->77123 77530 7ff7bc0d9580 54 API calls 77529->77530 77531 7ff7bc2608f0 77530->77531 77533 7ff7bc11f8f0 54 API calls 77531->77533 78331 7ff7bc25b4e0 47 API calls 77532->78331 77534 7ff7bc260920 77533->77534 77536 7ff7bc1188f0 51 API calls 77534->77536 77537 7ff7bc26093b 77536->77537 77538 7ff7bc267270 144 API calls 77537->77538 77539 7ff7bc260968 77538->77539 77540 7ff7bc0b9140 shared_ptr 47 API calls 77539->77540 77541 7ff7bc260976 77540->77541 77542 7ff7bc0b9140 shared_ptr 47 API calls 77541->77542 77544 7ff7bc260984 77542->77544 77543 7ff7bc260bdf 78332 7ff7bc25b760 47 API calls 77543->78332 77546 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77544->77546 77550 7ff7bc260992 77546->77550 77547 7ff7bc260c42 78333 7ff7bc267e90 51 API calls 77547->78333 77549 7ff7bc260c96 77551 7ff7bc0905d0 59 API calls 77549->77551 78330 7ff7bc25b360 51 API calls 2 library calls 77550->78330 77554 7ff7bc260ca1 77551->77554 77553 7ff7bc260a5f 77555 7ff7bc25c430 47 API calls 77553->77555 77556 7ff7bc0911a0 _Mpunct 51 API calls 77554->77556 77555->77471 77557 7ff7bc260cc6 77556->77557 77558 7ff7bc0d98a0 71 API calls 77557->77558 77559 7ff7bc260ce0 77558->77559 78334 7ff7bc255480 51 API calls shared_ptr 77559->78334 77561 7ff7bc260cf3 78335 7ff7bc0bc650 51 API calls 2 library calls 77561->78335 77563 7ff7bc260d1f Concurrency::details::WorkQueue::IsStructuredEmpty 77564 7ff7bc0904b0 69 API calls 77563->77564 77565 7ff7bc260d54 77564->77565 77566 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77565->77566 77567 7ff7bc260da1 77566->77567 77568 7ff7bc0d8e90 71 API calls 77567->77568 77569 7ff7bc260dbe allocator 77568->77569 77570 7ff7bc09a250 69 API calls 77569->77570 77571 7ff7bc260e05 UnDecorator::getVbTableType 77570->77571 77572 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77571->77572 77573 7ff7bc260e2f 77572->77573 77574 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77573->77574 77575 7ff7bc260e55 77574->77575 77576 7ff7bc0d8e90 71 API calls 77575->77576 77577 7ff7bc260e72 77576->77577 77578 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77577->77578 77579 7ff7bc260ebf 77578->77579 77580 7ff7bc0d8e90 71 API calls 77579->77580 77581 7ff7bc260edc 77580->77581 77582 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77581->77582 77583 7ff7bc260f29 77582->77583 77584 7ff7bc0d8e90 71 API calls 77583->77584 77585 7ff7bc260f46 77584->77585 77586 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 77585->77586 77587 7ff7bc260f93 77586->77587 77588 7ff7bc0d8e90 71 API calls 77587->77588 77589 7ff7bc260fb0 77588->77589 77590 7ff7bc11ca30 76 API calls 77589->77590 77591 7ff7bc261007 UnDecorator::getVbTableType 77590->77591 78336 7ff7bc0b91f0 51 API calls shared_ptr 77591->78336 77593->77478 77595 7ff7bc0911a0 _Mpunct 51 API calls 77594->77595 77596 7ff7bc0d9acd 77595->77596 77597 7ff7bc0d8170 51 API calls 77596->77597 77598 7ff7bc0d9ae0 77597->77598 77599 7ff7bc0d85c0 type_info::_name_internal_method 51 API calls 77598->77599 77600 7ff7bc0d9af6 77599->77600 77824 7ff7bc0ccad0 77600->77824 77603 7ff7bc0d9e60 51 API calls 77604 7ff7bc0d9b35 77603->77604 77605 7ff7bc0d8140 type_info::_name_internal_method 51 API calls 77604->77605 77606 7ff7bc0d9b56 77605->77606 77607 7ff7bc093c10 shared_ptr 47 API calls 77606->77607 77608 7ff7bc0d9b64 77607->77608 77609 7ff7bc093c10 shared_ptr 47 API calls 77608->77609 77610 7ff7bc0d9b72 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 77609->77610 77611 7ff7bc0d89d0 51 API calls 77610->77611 77616 7ff7bc0d9bad shared_ptr 77611->77616 77612 7ff7bc0d9c64 Concurrency::details::HardwareAffinity::operator!= 77613 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77612->77613 77615 7ff7bc0d9c91 77613->77615 77617 7ff7bc093c10 shared_ptr 47 API calls 77615->77617 77616->77612 77833 7ff7bc0d8200 47 API calls 77616->77833 77834 7ff7bc0d9cd0 51 API calls 2 library calls 77616->77834 77619 7ff7bc0d9c9f 77617->77619 77620 7ff7bc093c10 shared_ptr 47 API calls 77619->77620 77621 7ff7bc0d9cad 77620->77621 77622 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77621->77622 77623 7ff7bc0d9cbb 77622->77623 77623->77165 77625 7ff7bc090eb2 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::cancellation_token::_FromImpl _aligned_msize 77624->77625 77893 7ff7bc08b760 77625->77893 77627 7ff7bc090f16 77628 7ff7bc0d9580 77627->77628 77631 7ff7bc0d95ab shared_ptr 77628->77631 77629 7ff7bc0d8610 54 API calls 77630 7ff7bc0d9659 77629->77630 77632 7ff7bc0d966a 77630->77632 77633 7ff7bc0d96a7 shared_ptr 77630->77633 77631->77629 77634 7ff7bc0d7fa0 47 API calls 77632->77634 77901 7ff7bc0897a0 51 API calls 4 library calls 77633->77901 77635 7ff7bc0d968c 77634->77635 77636 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77635->77636 77637 7ff7bc0d969a 77636->77637 77653 7ff7bc11f8f0 77637->77653 77639 7ff7bc0d973d shared_ptr 77902 7ff7bc0897a0 51 API calls 4 library calls 77639->77902 77641 7ff7bc0d97f2 77642 7ff7bc0d9e60 51 API calls 77641->77642 77643 7ff7bc0d9810 77642->77643 77644 7ff7bc093c10 shared_ptr 47 API calls 77643->77644 77645 7ff7bc0d9855 77644->77645 77646 7ff7bc093c10 shared_ptr 47 API calls 77645->77646 77647 7ff7bc0d9863 77646->77647 77648 7ff7bc093c10 shared_ptr 47 API calls 77647->77648 77649 7ff7bc0d9871 77648->77649 77650 7ff7bc0d7fa0 47 API calls 77649->77650 77651 7ff7bc0d987c 77650->77651 77652 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77651->77652 77652->77637 77903 7ff7bc11ff10 77653->77903 77656 7ff7bc25caf0 77657 7ff7bc25cb23 77656->77657 77658 7ff7bc25cb2e 77657->77658 77659 7ff7bc25cb54 77657->77659 77943 7ff7bc255250 51 API calls 77658->77943 77944 7ff7bc0de140 51 API calls 77659->77944 77662 7ff7bc25cb66 CoTaskMemFree 77663 7ff7bc25cb80 77662->77663 77664 7ff7bc0b9140 shared_ptr 47 API calls 77663->77664 77665 7ff7bc25cb42 77664->77665 77666 7ff7bc1188f0 77665->77666 77670 7ff7bc118920 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= std::_Is_slash_oper::operator 77666->77670 77667 7ff7bc118afb 77946 7ff7bc0b7620 77667->77946 77670->77667 77675 7ff7bc118992 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= std::_Is_slash_oper::operator 77670->77675 77672 7ff7bc118b26 77673 7ff7bc0b9140 shared_ptr 47 API calls 77672->77673 77674 7ff7bc118af1 77673->77674 77674->77191 77945 7ff7bc117ee0 51 API calls 2 library calls 77675->77945 77677 7ff7bc118ac9 77678 7ff7bc0b9140 shared_ptr 47 API calls 77677->77678 77678->77674 77680 7ff7bc267856 77679->77680 77681 7ff7bc10bf80 75 API calls 77680->77681 77682 7ff7bc267864 77681->77682 77690 7ff7bc267bc6 77682->77690 77972 7ff7bc267140 77682->77972 77685 7ff7bc25c450 47 API calls 77687 7ff7bc25f3d8 77685->77687 77687->77199 77690->77685 77718 7ff7bc10bf93 77717->77718 77835 7ff7bc0c5230 77824->77835 77826 7ff7bc0ccaf3 77842 7ff7bc0cab10 77826->77842 77828 7ff7bc0ccb0b 77829 7ff7bc093c10 shared_ptr 47 API calls 77828->77829 77830 7ff7bc0ccb32 77829->77830 77846 7ff7bc0c58f0 77830->77846 77832 7ff7bc0ccb3d 77832->77603 77833->77616 77834->77616 77836 7ff7bc093410 std::ios_base::_Init 59 API calls 77835->77836 77837 7ff7bc0c5259 77836->77837 77838 7ff7bc2a2bd0 std::_Facet_Register 4 API calls 77837->77838 77839 7ff7bc0c52a3 77838->77839 77841 7ff7bc0c52bc 77839->77841 77851 7ff7bc0c4f30 87 API calls std::bad_exception::bad_exception 77839->77851 77841->77826 77843 7ff7bc0cab35 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 77842->77843 77852 7ff7bc0cab80 77843->77852 77847 7ff7bc093c10 shared_ptr 47 API calls 77846->77847 77848 7ff7bc0c5919 77847->77848 77849 7ff7bc093be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 77848->77849 77850 7ff7bc0c592a type_info::_name_internal_method 77849->77850 77850->77832 77851->77841 77853 7ff7bc0cabae 77852->77853 77854 7ff7bc0a2e10 51 API calls 77853->77854 77855 7ff7bc0cac11 77854->77855 77856 7ff7bc0caeab 77855->77856 77860 7ff7bc0cac5c Concurrency::details::HardwareAffinity::operator!= 77855->77860 77857 7ff7bc093c10 shared_ptr 47 API calls 77856->77857 77858 7ff7bc0caed8 77857->77858 77859 7ff7bc093c10 shared_ptr 47 API calls 77858->77859 77889 7ff7bc0cab66 77859->77889 77861 7ff7bc0cad28 77860->77861 77862 7ff7bc0cad18 77860->77862 77863 7ff7bc0cad34 77861->77863 77864 7ff7bc0cad62 Concurrency::details::HardwareAffinity::operator!= 77861->77864 77865 7ff7bc0cad23 77862->77865 77880 7ff7bc0cadf7 77862->77880 77866 7ff7bc0a2d10 type_info::_name_internal_method 51 API calls 77863->77866 77869 7ff7bc0cad72 77864->77869 77870 7ff7bc0cad87 77864->77870 77867 7ff7bc0cae4e 77865->77867 77868 7ff7bc0cae99 77865->77868 77871 7ff7bc0cad5c 77866->77871 77872 7ff7bc0910b0 51 API calls 77867->77872 77892 7ff7bc0c7f30 51 API calls 2 library calls 77868->77892 77874 7ff7bc0a2e10 51 API calls 77869->77874 77876 7ff7bc0cade5 77870->77876 77877 7ff7bc0cad97 77870->77877 77878 7ff7bc0cae6a 77872->77878 77874->77871 77890 7ff7bc0c7f30 51 API calls 2 library calls 77876->77890 77881 7ff7bc0910b0 51 API calls 77877->77881 77883 7ff7bc093c10 shared_ptr 47 API calls 77878->77883 77880->77871 77891 7ff7bc0cb9d0 51 API calls 2 library calls 77880->77891 77882 7ff7bc0cadb3 77881->77882 77884 7ff7bc093c10 shared_ptr 47 API calls 77882->77884 77885 7ff7bc0cae82 77883->77885 77886 7ff7bc0cadcb 77884->77886 77887 7ff7bc093c10 shared_ptr 47 API calls 77885->77887 77888 7ff7bc093c10 shared_ptr 47 API calls 77886->77888 77887->77889 77888->77889 77889->77828 77890->77871 77891->77880 77892->77871 77894 7ff7bc08b787 Concurrency::task_continuation_context::task_continuation_context 77893->77894 77895 7ff7bc08b796 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error Concurrency::task_continuation_context::task_continuation_context 77894->77895 77899 7ff7bc0a2970 51 API calls Concurrency::task_continuation_context::task_continuation_context 77894->77899 77898 7ff7bc08b7d2 type_info::_name_internal_method shared_ptr 77895->77898 77900 7ff7bc08af90 49 API calls Concurrency::task_continuation_context::task_continuation_context 77895->77900 77898->77627 77899->77895 77900->77898 77901->77639 77902->77641 77904 7ff7bc11ff3c 77903->77904 77907 7ff7bc117cb0 77904->77907 77912 7ff7bc287358 77907->77912 77933 7ff7bc2bab18 77912->77933 77915 7ff7bc28736a AreFileApisANSI 77916 7ff7bc117ce6 77915->77916 77917 7ff7bc119a70 77916->77917 77921 7ff7bc119a97 allocator List 77917->77921 77918 7ff7bc119ba8 77919 7ff7bc093c10 shared_ptr 47 API calls 77918->77919 77920 7ff7bc117d14 77919->77920 77920->77656 77921->77918 77923 7ff7bc119ad6 allocator 77921->77923 77938 7ff7bc104c30 51 API calls 2 library calls 77921->77938 77939 7ff7bc287380 MultiByteToWideChar GetLastError 77923->77939 77925 7ff7bc119b1b 77940 7ff7bc0ff420 51 API calls 77925->77940 77927 7ff7bc119b2a 77928 7ff7bc0ac710 51 API calls 77927->77928 77929 7ff7bc119b43 Concurrency::details::WorkQueue::IsStructuredEmpty allocator 77928->77929 77941 7ff7bc287380 MultiByteToWideChar GetLastError 77929->77941 77931 7ff7bc119b99 77942 7ff7bc0ff420 51 API calls 77931->77942 77934 7ff7bc2c09fc _Getctype 47 API calls 77933->77934 77935 7ff7bc2bab21 77934->77935 77936 7ff7bc2c0e70 _Getctype 47 API calls 77935->77936 77937 7ff7bc287361 77936->77937 77937->77915 77937->77916 77938->77923 77939->77925 77940->77927 77941->77931 77942->77918 77943->77665 77944->77662 77945->77677 77947 7ff7bc0910b0 51 API calls 77946->77947 77948 7ff7bc0b764a 77947->77948 77949 7ff7bc118cd0 77948->77949 77950 7ff7bc118ceb 77949->77950 77951 7ff7bc118cf2 77950->77951 77955 7ff7bc118d0c Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 77950->77955 77967 7ff7bc118640 51 API calls task 77951->77967 77953 7ff7bc118d07 77953->77672 77954 7ff7bc118ddd std::_Is_slash_oper::operator 77956 7ff7bc118e37 77954->77956 77962 7ff7bc118e04 77954->77962 77955->77954 77959 7ff7bc118dc3 77955->77959 77957 7ff7bc118e43 77956->77957 77963 7ff7bc118e7a std::_Is_slash_oper::operator 77956->77963 77958 7ff7bc118e31 77957->77958 77970 7ff7bc0cb9d0 51 API calls 2 library calls 77957->77970 77964 7ff7bc0a2d10 type_info::_name_internal_method 51 API calls 77958->77964 77968 7ff7bc118640 51 API calls task 77959->77968 77969 7ff7bc11a370 51 API calls type_info::_name_internal_method 77962->77969 77963->77958 77971 7ff7bc0cb9d0 51 API calls 2 library calls 77963->77971 77964->77953 77967->77953 77968->77953 77969->77958 77970->77958 77971->77958 77985 7ff7bc267ff0 77972->77985 77974 7ff7bc267158 77990 7ff7bc101930 77985->77990 77987 7ff7bc26804d 77987->77974 77988 7ff7bc268015 77988->77987 77994 7ff7bc124810 56 API calls 4 library calls 77988->77994 77991 7ff7bc10194f Concurrency::details::WorkQueue::IsStructuredEmpty 77990->77991 77995 7ff7bc2876a8 77991->77995 77993 7ff7bc101977 77993->77988 77994->77987 77999 7ff7bc2876ea 77995->77999 77996 7ff7bc2876f3 77997 7ff7bc2a31a0 std::_Throw_Cpp_error 8 API calls 77996->77997 78000 7ff7bc28798b 77997->78000 77998 7ff7bc287805 78038 7ff7bc2879d8 CreateFileW GetLastError 77998->78038 77999->77996 77999->77998 78002 7ff7bc28774b GetFileAttributesExW 77999->78002 78000->77993 78004 7ff7bc2877b0 78002->78004 78005 7ff7bc28775f GetLastError 78002->78005 78003 7ff7bc287828 78006 7ff7bc28784e 78003->78006 78007 7ff7bc28782e 78003->78007 78004->77996 78004->77998 78005->77996 78008 7ff7bc28776e FindFirstFileW 78005->78008 78012 7ff7bc28785d GetFileInformationByHandleEx 78006->78012 78013 7ff7bc2878fb 78006->78013 78011 7ff7bc287839 CloseHandle 78007->78011 78023 7ff7bc287847 78007->78023 78009 7ff7bc28778d FindClose 78008->78009 78010 7ff7bc287782 GetLastError 78008->78010 78009->78004 78010->77996 78014 7ff7bc2879bd 78011->78014 78011->78023 78017 7ff7bc28789d 78012->78017 78018 7ff7bc287877 GetLastError 78012->78018 78015 7ff7bc287916 GetFileInformationByHandleEx 78013->78015 78016 7ff7bc287950 78013->78016 78015->78016 78022 7ff7bc28792c GetLastError 78015->78022 78019 7ff7bc287967 78016->78019 78020 7ff7bc2879a3 78016->78020 78017->78013 78027 7ff7bc2878be GetFileInformationByHandleEx 78017->78027 78018->78023 78024 7ff7bc287885 CloseHandle 78018->78024 78019->77996 78020->78023 78022->78023 78023->77996 78024->78023 78027->78013 78038->78003 78328->77451 78329->77480 78330->77553 78331->77543 78332->77547 78333->77549 78334->77561 78335->77563 78336->77593 78337 7ff7bc0916d0 78338 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78337->78338 78339 7ff7bc091718 78338->78339 78340 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78339->78340 78341 7ff7bc091742 78340->78341 78342 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78341->78342 78343 7ff7bc09176c 78342->78343 78344 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78343->78344 78345 7ff7bc0917a8 78344->78345 78346 7ff7bc0911a0 _Mpunct 51 API calls 78345->78346 78347 7ff7bc091942 78346->78347 78348 7ff7bc0905d0 59 API calls 78347->78348 78349 7ff7bc091970 78348->78349 78474 7ff7bc23e070 78349->78474 78351 7ff7bc09199c 78482 7ff7bc0c1780 78351->78482 78353 7ff7bc0919ca 78488 7ff7bc12f5c0 78353->78488 78357 7ff7bc0919f7 78498 7ff7bc254db0 78357->78498 78359 7ff7bc091a4a 78360 7ff7bc0911a0 _Mpunct 51 API calls 78359->78360 78361 7ff7bc091b83 78360->78361 78362 7ff7bc0d98a0 71 API calls 78361->78362 78363 7ff7bc091ba0 allocator 78362->78363 78364 7ff7bc0911a0 _Mpunct 51 API calls 78363->78364 78365 7ff7bc091bd5 UnDecorator::getVbTableType 78364->78365 78366 7ff7bc0910b0 51 API calls 78365->78366 78367 7ff7bc091c09 allocator 78366->78367 78368 7ff7bc091c3b CreateEventW 78367->78368 78369 7ff7bc091c67 UnDecorator::getVbTableType 78368->78369 78501 7ff7bc0997a0 GetDesktopWindow EnumChildWindows 78369->78501 78371 7ff7bc091c75 78372 7ff7bc2a2bd0 std::_Facet_Register 4 API calls 78371->78372 78373 7ff7bc091c80 78372->78373 78374 7ff7bc091c9f 78373->78374 78614 7ff7bc12c0b0 74 API calls 4 library calls 78373->78614 78376 7ff7bc2a2bd0 std::_Facet_Register 4 API calls 78374->78376 78377 7ff7bc091cda 78376->78377 78378 7ff7bc091cf3 78377->78378 78615 7ff7bc1340f0 49 API calls 78377->78615 78502 7ff7bc12e000 78378->78502 78382 7ff7bc2a2bd0 std::_Facet_Register 4 API calls 78383 7ff7bc091d43 78382->78383 78384 7ff7bc091d62 78383->78384 78509 7ff7bc130320 78383->78509 78386 7ff7bc253e60 50 API calls 78384->78386 78387 7ff7bc091da4 78386->78387 78512 7ff7bc0a4410 78387->78512 78389 7ff7bc091db1 78390 7ff7bc095950 60 API calls 78389->78390 78391 7ff7bc091dd5 allocator 78390->78391 78392 7ff7bc091dea CreateDirectoryW 78391->78392 78393 7ff7bc091e02 UnDecorator::getVbTableType 78392->78393 78394 7ff7bc0911a0 _Mpunct 51 API calls 78393->78394 78395 7ff7bc091e27 78394->78395 78396 7ff7bc0d98a0 71 API calls 78395->78396 78397 7ff7bc091e44 allocator 78396->78397 78398 7ff7bc0911a0 _Mpunct 51 API calls 78397->78398 78399 7ff7bc091e79 UnDecorator::getVbTableType 78398->78399 78400 7ff7bc0910b0 51 API calls 78399->78400 78401 7ff7bc091ead allocator 78400->78401 78402 7ff7bc091edf CreateEventW 78401->78402 78403 7ff7bc091f0b UnDecorator::getVbTableType 78402->78403 78529 7ff7bc0a4620 78403->78529 78475 7ff7bc23e0a5 78474->78475 78476 7ff7bc23e0db CoInitializeEx 78475->78476 78477 7ff7bc23e0f3 78476->78477 78481 7ff7bc23e0f1 78476->78481 78631 7ff7bc0f9be0 CoCreateInstance 78477->78631 78479 7ff7bc23e11b 78479->78481 78632 7ff7bc23e460 78479->78632 78481->78351 78483 7ff7bc0c17b3 78482->78483 78484 7ff7bc090510 67 API calls 78483->78484 78485 7ff7bc0c17c5 78484->78485 78708 7ff7bc0c1a20 78485->78708 78487 7ff7bc0c17d7 UnDecorator::getVbTableType 78487->78353 78717 7ff7bc26af60 78488->78717 78490 7ff7bc12f5d6 78722 7ff7bc12f480 78490->78722 78493 7ff7bc139690 78750 7ff7bc0c5030 78493->78750 78496 7ff7bc0c5030 49 API calls 78497 7ff7bc1396b8 78496->78497 78497->78357 78499 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78498->78499 78500 7ff7bc254ddc 78499->78500 78500->78359 78501->78371 78774 7ff7bc12ad20 78502->78774 78505 7ff7bc12cd80 47 API calls 78506 7ff7bc12e04e 78505->78506 78507 7ff7bc094e10 47 API calls 78506->78507 78508 7ff7bc091d38 78507->78508 78508->78382 78787 7ff7bc1317f0 78509->78787 78513 7ff7bc253e60 50 API calls 78512->78513 78514 7ff7bc0a4421 Concurrency::details::_Scheduler::_Scheduler 78513->78514 78515 7ff7bc090510 67 API calls 78514->78515 78516 7ff7bc0a447f 78515->78516 78800 7ff7bc253f40 78516->78800 78518 7ff7bc0a44a9 Concurrency::details::_Scheduler::_Scheduler UnDecorator::getVbTableType 78519 7ff7bc090510 67 API calls 78518->78519 78520 7ff7bc0a4517 78519->78520 78521 7ff7bc253f40 55 API calls 78520->78521 78522 7ff7bc0a4547 UnDecorator::getVbTableType 78521->78522 78821 7ff7bc2542a0 78522->78821 78524 7ff7bc0a4562 Concurrency::details::_Scheduler::_Scheduler 78525 7ff7bc090510 67 API calls 78524->78525 78526 7ff7bc0a45d1 78525->78526 78527 7ff7bc253f40 55 API calls 78526->78527 78528 7ff7bc0a4601 UnDecorator::getVbTableType 78527->78528 78528->78389 78530 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78529->78530 78534 7ff7bc0a464c 78530->78534 78531 7ff7bc0a4692 78833 7ff7bc116c50 78531->78833 78534->78531 78849 7ff7bc09c050 50 API calls 3 library calls 78534->78849 78614->78374 78615->78378 78631->78479 78633 7ff7bc0911a0 _Mpunct 51 API calls 78632->78633 78634 7ff7bc23e49d 78633->78634 78635 7ff7bc0d98a0 71 API calls 78634->78635 78636 7ff7bc23e4b7 78635->78636 78637 7ff7bc0911a0 _Mpunct 51 API calls 78636->78637 78638 7ff7bc23e4dc 78637->78638 78639 7ff7bc0d98a0 71 API calls 78638->78639 78640 7ff7bc23e4f6 allocator Concurrency::details::HardwareAffinity::operator!= shared_ptr 78639->78640 78673 7ff7bc23e5e9 UnDecorator::getVbTableType 78640->78673 78674 7ff7bc2392b0 78640->78674 78642 7ff7bc23e7ca allocator shared_ptr 78643 7ff7bc2392b0 3 API calls 78642->78643 78646 7ff7bc23e830 allocator shared_ptr 78643->78646 78644 7ff7bc23ebfd 78689 7ff7bc0f7300 #6 78644->78689 78646->78644 78649 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78646->78649 78647 7ff7bc23ec07 78690 7ff7bc0f7300 #6 78647->78690 78650 7ff7bc23e8f6 78649->78650 78651 7ff7bc0d8e90 71 API calls 78650->78651 78652 7ff7bc23e913 allocator 78651->78652 78653 7ff7bc23e950 #7 78652->78653 78654 7ff7bc23e96a allocator 78653->78654 78682 7ff7bc0c49e0 78654->78682 78657 7ff7bc126bb0 allocator 2 API calls 78658 7ff7bc23e9d7 78657->78658 78659 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 78658->78659 78663 7ff7bc23ead5 UnDecorator::getVbTableType 78658->78663 78660 7ff7bc23ea04 78659->78660 78661 7ff7bc0d8e90 71 API calls 78660->78661 78662 7ff7bc23ea21 allocator 78661->78662 78665 7ff7bc23ea5e #7 78662->78665 78663->78644 78664 7ff7bc23eb7c 78663->78664 78687 7ff7bc0f7300 #6 78664->78687 78666 7ff7bc23ea78 allocator 78665->78666 78668 7ff7bc0c49e0 59 API calls 78666->78668 78669 7ff7bc23ea9d 78668->78669 78671 7ff7bc126bb0 allocator 2 API calls 78669->78671 78670 7ff7bc23eba3 78688 7ff7bc0f7300 #6 78670->78688 78671->78663 78673->78481 78675 7ff7bc2392c4 78674->78675 78679 7ff7bc2392ce 78674->78679 78691 7ff7bc098370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 78675->78691 78676 7ff7bc2392d6 78676->78642 78677 7ff7bc2392e4 #4 78680 7ff7bc239302 List 78677->78680 78679->78676 78679->78677 78680->78676 78692 7ff7bc098370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 78680->78692 78683 7ff7bc09a5a0 57 API calls 78682->78683 78684 7ff7bc0c49f8 78683->78684 78693 7ff7bc0c4880 78684->78693 78687->78670 78688->78673 78689->78647 78690->78673 78691->78679 78692->78676 78694 7ff7bc0c4898 78693->78694 78694->78694 78696 7ff7bc0c48d8 78694->78696 78705 7ff7bc098370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 78694->78705 78697 7ff7bc0c48f1 78696->78697 78706 7ff7bc098370 RtlPcToFileHeader RaiseException std::_Throw_Cpp_error atomic 78696->78706 78699 7ff7bc0c4927 UnDecorator::getVbTableType 78697->78699 78707 7ff7bc09ea20 RtlPcToFileHeader RaiseException strrchr 78697->78707 78701 7ff7bc09c0d0 UnDecorator::getVbTableType 2 API calls 78699->78701 78702 7ff7bc0c4945 78701->78702 78703 7ff7bc0b0d40 UnDecorator::getVbTableType 47 API calls 78702->78703 78704 7ff7bc0c496d 78703->78704 78704->78657 78705->78694 78706->78697 78707->78699 78709 7ff7bc0c1a6a 78708->78709 78710 7ff7bc0c1a38 78708->78710 78709->78487 78711 7ff7bc2a2bd0 std::_Facet_Register 4 API calls 78710->78711 78712 7ff7bc0c1a42 78711->78712 78712->78709 78713 7ff7bc0c1a4f 78712->78713 78716 7ff7bc1409e0 76 API calls 5 library calls 78713->78716 78715 7ff7bc0c1a63 78715->78709 78716->78715 78726 7ff7bc25bef0 78717->78726 78719 7ff7bc26af9e memcpy_s 78720 7ff7bc26b002 WlanAllocateMemory 78719->78720 78721 7ff7bc26b02b memcpy_s 78720->78721 78721->78490 78723 7ff7bc12f496 78722->78723 78724 7ff7bc12f4db CoInitializeEx CoInitializeSecurity CoCreateInstance IcmpCreateFile 78723->78724 78725 7ff7bc0919e0 78724->78725 78725->78493 78729 7ff7bc25bb40 78726->78729 78730 7ff7bc25bb71 78729->78730 78733 7ff7bc25d9a0 78730->78733 78732 7ff7bc25bb7c 78732->78719 78734 7ff7bc25d9b3 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error 78733->78734 78737 7ff7bc256250 78734->78737 78736 7ff7bc25d9ea shared_ptr 78736->78732 78740 7ff7bc25f010 78737->78740 78739 7ff7bc256268 type_info::_name_internal_method 78739->78736 78745 7ff7bc258170 78740->78745 78743 7ff7bc08aef0 allocator 49 API calls 78744 7ff7bc25f030 78743->78744 78744->78739 78746 7ff7bc25819e 78745->78746 78747 7ff7bc2581a3 78745->78747 78749 7ff7bc0a2260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error std::_Throw_Cpp_error 78746->78749 78747->78743 78749->78747 78753 7ff7bc0c4a20 78750->78753 78754 7ff7bc0c4a51 78753->78754 78757 7ff7bc0c6da0 78754->78757 78756 7ff7bc0c4a5c 78756->78496 78758 7ff7bc0c6db3 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error 78757->78758 78761 7ff7bc0c27d0 78758->78761 78760 7ff7bc0c6dea shared_ptr 78760->78756 78764 7ff7bc0c80e0 78761->78764 78763 7ff7bc0c27e8 type_info::_name_internal_method 78763->78760 78769 7ff7bc0c37a0 78764->78769 78767 7ff7bc08aef0 allocator 49 API calls 78768 7ff7bc0c8100 78767->78768 78768->78763 78770 7ff7bc0c37d3 78769->78770 78771 7ff7bc0c37ce 78769->78771 78770->78767 78773 7ff7bc0a2260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error std::_Throw_Cpp_error 78771->78773 78773->78770 78775 7ff7bc12ad3d shared_ptr 78774->78775 78778 7ff7bc12b530 78775->78778 78777 7ff7bc12ad65 78777->78505 78779 7ff7bc12b550 shared_ptr 78778->78779 78780 7ff7bc08fc90 4 API calls 78779->78780 78781 7ff7bc12b578 allocator 78780->78781 78782 7ff7bc2afc38 52 API calls 78781->78782 78783 7ff7bc12b5c0 78782->78783 78785 7ff7bc12b5d3 type_info::_name_internal_method 78783->78785 78786 7ff7bc281c68 51 API calls std::_Throw_Cpp_error 78783->78786 78785->78777 78794 7ff7bc131860 6 API calls 78787->78794 78789 7ff7bc131808 78790 7ff7bc131860 9 API calls 78789->78790 78791 7ff7bc131820 78790->78791 78792 7ff7bc131860 9 API calls 78791->78792 78793 7ff7bc130421 78792->78793 78793->78384 78798 7ff7bc2d3ad0 78794->78798 78797 7ff7bc131940 78797->78789 78799 7ff7bc131908 GlobalUnlock CreateStreamOnHGlobal GetLastError 78798->78799 78799->78797 78802 7ff7bc253f7f 78800->78802 78801 7ff7bc254281 78801->78518 78802->78801 78803 7ff7bc253fb7 78802->78803 78804 7ff7bc254109 78802->78804 78805 7ff7bc2a2bd0 std::_Facet_Register 4 API calls 78803->78805 78806 7ff7bc2a2bd0 std::_Facet_Register 4 API calls 78804->78806 78809 7ff7bc253fd7 78805->78809 78810 7ff7bc254129 78806->78810 78807 7ff7bc2541a9 78831 7ff7bc111f20 51 API calls shared_ptr 78807->78831 78811 7ff7bc254045 78809->78811 78827 7ff7bc253170 49 API calls Concurrency::details::SchedulerBase::GetPolicy 78809->78827 78810->78807 78830 7ff7bc253170 49 API calls Concurrency::details::SchedulerBase::GetPolicy 78810->78830 78828 7ff7bc2549a0 51 API calls shared_ptr 78811->78828 78812 7ff7bc2541eb allocator 78815 7ff7bc2541f9 AppendMenuW 78812->78815 78817 7ff7bc254103 78815->78817 78832 7ff7bc253010 51 API calls Concurrency::details::WorkQueue::IsStructuredEmpty 78817->78832 78818 7ff7bc2540f5 78829 7ff7bc254340 3 API calls 6 library calls 78818->78829 78822 7ff7bc2542c6 78821->78822 78823 7ff7bc090510 67 API calls 78822->78823 78824 7ff7bc2542f0 78823->78824 78825 7ff7bc253f40 55 API calls 78824->78825 78826 7ff7bc254322 UnDecorator::getVbTableType 78825->78826 78826->78524 78827->78811 78828->78818 78829->78817 78830->78807 78831->78812 78832->78801 78849->78534 79054 7ff7bc0c51f0 79057 7ff7bc0c4ef0 79054->79057 79056 7ff7bc0c51fc 79060 7ff7bc0c4e70 79057->79060 79061 7ff7bc0c4e96 std::bad_exception::bad_exception 79060->79061 79068 7ff7bc092c70 79061->79068 79069 7ff7bc2813e8 std::_Lockit::_Lockit 6 API calls 79068->79069 79070 7ff7bc092c94 _Yarn 79069->79070 79071 7ff7bc092d09 79070->79071 79072 7ff7bc092d1b 79070->79072 79096 7ff7bc28200c 79071->79096 79103 7ff7bc2818e0 51 API calls 2 library calls 79072->79103 79075 7ff7bc092d18 79076 7ff7bc0c73c0 79075->79076 79141 7ff7bc0a0020 79076->79141 79079 7ff7bc094b10 79164 7ff7bc282078 79079->79164 79084 7ff7bc093a50 std::bad_exception::bad_exception 13 API calls 79085 7ff7bc094b46 79084->79085 79086 7ff7bc093a50 std::bad_exception::bad_exception 13 API calls 79085->79086 79087 7ff7bc094b57 79086->79087 79088 7ff7bc093a50 std::bad_exception::bad_exception 13 API calls 79087->79088 79089 7ff7bc094b68 79088->79089 79090 7ff7bc093a50 std::bad_exception::bad_exception 13 API calls 79089->79090 79091 7ff7bc094b79 79090->79091 79092 7ff7bc093a50 std::bad_exception::bad_exception 13 API calls 79091->79092 79093 7ff7bc094b8a 79092->79093 79094 7ff7bc281460 std::_Lockit::~_Lockit LeaveCriticalSection 79093->79094 79095 7ff7bc094b97 79094->79095 79095->79056 79104 7ff7bc2baa9c 79096->79104 79103->79075 79110 7ff7bc2c3cf4 79104->79110 79131 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79110->79131 79112 7ff7bc2c3d14 79132 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79112->79132 79114 7ff7bc2c3d33 79133 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79114->79133 79116 7ff7bc2c3d52 79134 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79116->79134 79118 7ff7bc2c3d71 79135 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79118->79135 79120 7ff7bc2c3d90 79136 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79120->79136 79122 7ff7bc2c3daf 79137 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79122->79137 79124 7ff7bc2c3dce 79138 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79124->79138 79126 7ff7bc2c3ded 79139 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79126->79139 79128 7ff7bc2c3e0c 79140 7ff7bc2c32c8 5 API calls __crtLCMapStringW 79128->79140 79130 7ff7bc2c3e2b 79131->79112 79132->79114 79133->79116 79134->79118 79135->79120 79136->79122 79137->79124 79138->79126 79139->79128 79140->79130 79144 7ff7bc282390 79141->79144 79145 7ff7bc2bab18 _Getctype 47 API calls 79144->79145 79146 7ff7bc2823b5 79145->79146 79153 7ff7bc2babac 79146->79153 79152 7ff7bc0a003a 79152->79079 79154 7ff7bc2c09fc _Getctype 47 API calls 79153->79154 79155 7ff7bc2babb5 79154->79155 79156 7ff7bc2c0e70 _Getctype 47 API calls 79155->79156 79157 7ff7bc2823bc 79156->79157 79158 7ff7bc2bab78 79157->79158 79159 7ff7bc2c09fc _Getctype 47 API calls 79158->79159 79160 7ff7bc2bab81 79159->79160 79161 7ff7bc2c0e70 _Getctype 47 API calls 79160->79161 79162 7ff7bc2823c4 79161->79162 79162->79152 79163 7ff7bc2baae8 47 API calls _Getctype 79162->79163 79163->79152 79165 7ff7bc094b23 79164->79165 79166 7ff7bc282085 79164->79166 79168 7ff7bc093a50 79165->79168 79167 7ff7bc2baa9c std::_Locinfo::_Locinfo_ctor 81 API calls 79166->79167 79167->79165 79171 7ff7bc0a2360 79168->79171 79172 7ff7bc0a2374 79171->79172 79174 7ff7bc093a63 79171->79174 79175 7ff7bc2a9ad0 13 API calls 2 library calls 79172->79175 79174->79084 79175->79174 79176 7ff7bc0e42b0 79179 7ff7bc2b689c 79176->79179 79180 7ff7bc2b68d6 79179->79180 79181 7ff7bc2b68b8 79179->79181 79200 7ff7bc2b6450 EnterCriticalSection 79180->79200 79201 7ff7bc2a90f0 11 API calls _get_daylight 79181->79201 79185 7ff7bc2b68bd 79202 7ff7bc2a8f84 47 API calls _invalid_parameter_noinfo_noreturn 79185->79202 79189 7ff7bc0e42c8 79201->79185 79202->79189 79203 7ff7bc0fc490 GetWindowTextW 79204 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79203->79204 79205 7ff7bc0fc4eb 79204->79205 79206 7ff7bc0d8e90 71 API calls 79205->79206 79207 7ff7bc0fc4ff allocator ProcessCodePage 79206->79207 79208 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79207->79208 79215 7ff7bc0fc569 allocator ProcessCodePage UnDecorator::getVbTableType 79207->79215 79209 7ff7bc0fc555 79208->79209 79210 7ff7bc0d8e90 71 API calls 79209->79210 79210->79215 79211 7ff7bc0fc63e 79212 7ff7bc0911a0 _Mpunct 51 API calls 79213 7ff7bc0fc613 79212->79213 79218 7ff7bc0f8130 51 API calls shared_ptr 79213->79218 79215->79211 79215->79212 79216 7ff7bc0fc626 79217 7ff7bc093c10 shared_ptr 47 API calls 79216->79217 79217->79211 79218->79216 79219 7ff7bc28f5e8 79220 7ff7bc28f6b5 79219->79220 79221 7ff7bc28f60d 79219->79221 79221->79220 79222 7ff7bc2a2bd0 std::_Facet_Register 4 API calls 79221->79222 79224 7ff7bc28f61e 79222->79224 79223 7ff7bc28f69b 79223->79220 79226 7ff7bc094b10 std::bad_exception::bad_exception 84 API calls 79223->79226 79224->79223 79225 7ff7bc092c70 std::bad_exception::bad_exception 86 API calls 79224->79225 79227 7ff7bc28f657 79225->79227 79226->79220 79231 7ff7bc289cb4 79227->79231 79229 7ff7bc28f696 79246 7ff7bc2a23bc 48 API calls _Getcoll 79229->79246 79232 7ff7bc282390 std::bad_exception::bad_exception 47 API calls 79231->79232 79233 7ff7bc289cdc 79232->79233 79247 7ff7bc2bb3f8 79233->79247 79236 7ff7bc289d22 79260 7ff7bc2bb544 79236->79260 79238 7ff7bc289d1a 79274 7ff7bc2a9ad0 13 API calls 2 library calls 79238->79274 79242 7ff7bc289d63 79242->79229 79244 7ff7bc289d5b 79276 7ff7bc2a9ad0 13 API calls 2 library calls 79244->79276 79246->79223 79248 7ff7bc2bb400 79247->79248 79249 7ff7bc2b0764 TranslateName 47 API calls 79248->79249 79250 7ff7bc2bb424 79249->79250 79251 7ff7bc2c0e10 std::_Locinfo::_Locinfo_ctor 12 API calls 79250->79251 79258 7ff7bc2bb476 79251->79258 79252 7ff7bc2c0dd4 __free_lconv_num 11 API calls 79253 7ff7bc289d03 79252->79253 79253->79236 79273 7ff7bc0c5a10 13 API calls 2 library calls 79253->79273 79254 7ff7bc2bb52d 79277 7ff7bc2a8fd4 IsProcessorFeaturePresent 79254->79277 79257 7ff7bc2c05f8 47 API calls __std_exception_copy 79257->79258 79258->79254 79258->79257 79258->79258 79259 7ff7bc2bb4f3 79258->79259 79259->79252 79261 7ff7bc2bb54c 79260->79261 79262 7ff7bc2b0764 TranslateName 47 API calls 79261->79262 79263 7ff7bc2bb570 79262->79263 79264 7ff7bc2c0e10 std::_Locinfo::_Locinfo_ctor 12 API calls 79263->79264 79272 7ff7bc2bb5c8 79264->79272 79265 7ff7bc2bb652 79266 7ff7bc2c0dd4 __free_lconv_num 11 API calls 79265->79266 79267 7ff7bc289d44 79266->79267 79267->79242 79275 7ff7bc0c5a10 13 API calls 2 library calls 79267->79275 79268 7ff7bc2c05f8 47 API calls __std_exception_copy 79268->79272 79269 7ff7bc2bb68c 79270 7ff7bc2a8fd4 _invalid_parameter_noinfo_noreturn 17 API calls 79269->79270 79271 7ff7bc2bb6a1 79270->79271 79272->79265 79272->79268 79272->79269 79272->79272 79273->79238 79274->79236 79275->79244 79276->79242 79278 7ff7bc2a8fe7 79277->79278 79281 7ff7bc2a8cb8 14 API calls 3 library calls 79278->79281 79280 7ff7bc2a9002 GetCurrentProcess TerminateProcess 79281->79280 79282 7ff7bc081bb1 79321 7ff7bc0cfc70 49 API calls 2 library calls 79282->79321 79284 7ff7bc081be9 79285 7ff7bc0910b0 51 API calls 79284->79285 79286 7ff7bc081c08 79285->79286 79322 7ff7bc0cfc70 49 API calls 2 library calls 79286->79322 79288 7ff7bc081c69 79289 7ff7bc0910b0 51 API calls 79288->79289 79290 7ff7bc081c8e 79289->79290 79323 7ff7bc0cfc70 49 API calls 2 library calls 79290->79323 79292 7ff7bc081cf5 79293 7ff7bc0910b0 51 API calls 79292->79293 79294 7ff7bc081d1a 79293->79294 79324 7ff7bc0cfc70 49 API calls 2 library calls 79294->79324 79296 7ff7bc081d81 79297 7ff7bc0910b0 51 API calls 79296->79297 79298 7ff7bc081da6 79297->79298 79325 7ff7bc0cfc70 49 API calls 2 library calls 79298->79325 79300 7ff7bc081e0d 79301 7ff7bc0910b0 51 API calls 79300->79301 79302 7ff7bc081e32 79301->79302 79326 7ff7bc0cfc70 49 API calls 2 library calls 79302->79326 79304 7ff7bc081e99 79305 7ff7bc0910b0 51 API calls 79304->79305 79306 7ff7bc081ebe 79305->79306 79327 7ff7bc0cfc70 49 API calls 2 library calls 79306->79327 79308 7ff7bc081f25 79309 7ff7bc0910b0 51 API calls 79308->79309 79310 7ff7bc081f4a 79309->79310 79328 7ff7bc0cfc70 49 API calls 2 library calls 79310->79328 79312 7ff7bc081fb1 79313 7ff7bc0910b0 51 API calls 79312->79313 79314 7ff7bc081fd6 79313->79314 79329 7ff7bc0cfc70 49 API calls 2 library calls 79314->79329 79316 7ff7bc08203d std::_Fac_node::_Fac_node 79330 7ff7bc0d29f0 51 API calls 79316->79330 79318 7ff7bc082087 UnDecorator::getVbTableType 79331 7ff7bc2a2e3c 50 API calls 79318->79331 79320 7ff7bc082132 79321->79284 79322->79288 79323->79292 79324->79296 79325->79300 79326->79304 79327->79308 79328->79312 79329->79316 79330->79318 79331->79320 79332 7ff7bc081270 79333 7ff7bc0911a0 _Mpunct 51 API calls 79332->79333 79334 7ff7bc08128f 79333->79334 79335 7ff7bc0d98a0 71 API calls 79334->79335 79336 7ff7bc0812a3 allocator 79335->79336 79337 7ff7bc0911a0 _Mpunct 51 API calls 79336->79337 79338 7ff7bc0812cb UnDecorator::getVbTableType 79337->79338 79341 7ff7bc2a2e3c 50 API calls 79338->79341 79340 7ff7bc0812e3 79341->79340 79342 7ff7bc081b50 79347 7ff7bc0cfc10 79342->79347 79345 7ff7bc0910b0 51 API calls 79346 7ff7bc081b9a 79345->79346 79348 7ff7bc0cfc2d shared_ptr 79347->79348 79349 7ff7bc0904b0 69 API calls 79348->79349 79350 7ff7bc081b7b 79349->79350 79350->79345 79351 7ff7bc09e340 79352 7ff7bc09e395 79351->79352 79353 7ff7bc09e36c 79351->79353 79354 7ff7bc09e3a3 79352->79354 79355 7ff7bc09e425 79352->79355 79361 7ff7bc09e9ba PostQuitMessage 79353->79361 79362 7ff7bc09e389 79353->79362 79426 7ff7bc09e3b6 UnDecorator::getVbTableType 79353->79426 79358 7ff7bc09e390 DefWindowProcW 79354->79358 79354->79426 79356 7ff7bc09e434 79355->79356 79357 7ff7bc09e6dd 79355->79357 79360 7ff7bc0911a0 _Mpunct 51 API calls 79356->79360 79365 7ff7bc0911a0 _Mpunct 51 API calls 79357->79365 79357->79426 79363 7ff7bc09e414 79358->79363 79359 7ff7bc09e9ec DefWindowProcW 79359->79363 79366 7ff7bc09e458 79360->79366 79361->79359 79362->79358 79367 7ff7bc09e3bb 79362->79367 79368 7ff7bc09e710 79365->79368 79369 7ff7bc0d98a0 71 API calls 79366->79369 79370 7ff7bc09e3ef 79367->79370 79371 7ff7bc09e3d3 PostMessageW 79367->79371 79372 7ff7bc0d98a0 71 API calls 79368->79372 79373 7ff7bc09e472 79369->79373 79370->79363 79374 7ff7bc09e3fa PostMessageW 79370->79374 79371->79363 79375 7ff7bc09e72d 79372->79375 79376 7ff7bc0911a0 _Mpunct 51 API calls 79373->79376 79374->79363 79377 7ff7bc0911a0 _Mpunct 51 API calls 79375->79377 79378 7ff7bc09e497 79376->79378 79379 7ff7bc09e752 79377->79379 79380 7ff7bc0d98a0 71 API calls 79378->79380 79381 7ff7bc0d98a0 71 API calls 79379->79381 79382 7ff7bc09e4b1 79380->79382 79383 7ff7bc09e76c 79381->79383 79384 7ff7bc0911a0 _Mpunct 51 API calls 79382->79384 79385 7ff7bc0911a0 _Mpunct 51 API calls 79383->79385 79386 7ff7bc09e4d6 79384->79386 79387 7ff7bc09e791 79385->79387 79388 7ff7bc0d98a0 71 API calls 79386->79388 79389 7ff7bc0d98a0 71 API calls 79387->79389 79390 7ff7bc09e4f0 79388->79390 79391 7ff7bc09e7ab 79389->79391 79392 7ff7bc090510 67 API calls 79390->79392 79393 7ff7bc090510 67 API calls 79391->79393 79394 7ff7bc09e502 79392->79394 79395 7ff7bc09e7bd 79393->79395 79396 7ff7bc090510 67 API calls 79394->79396 79398 7ff7bc090510 67 API calls 79395->79398 79397 7ff7bc09e514 79396->79397 79400 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79397->79400 79399 7ff7bc09e7cf 79398->79399 79401 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79399->79401 79402 7ff7bc09e537 79400->79402 79403 7ff7bc09e7f2 79401->79403 79404 7ff7bc0d8e90 71 API calls 79402->79404 79405 7ff7bc0d8e90 71 API calls 79403->79405 79406 7ff7bc09e554 79404->79406 79407 7ff7bc09e80f 79405->79407 79408 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79406->79408 79409 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79407->79409 79410 7ff7bc09e59e 79408->79410 79411 7ff7bc09e859 79409->79411 79412 7ff7bc0d8e90 71 API calls 79410->79412 79413 7ff7bc0d8e90 71 API calls 79411->79413 79414 7ff7bc09e5bb 79412->79414 79415 7ff7bc09e876 79413->79415 79416 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79414->79416 79417 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79415->79417 79418 7ff7bc09e605 79416->79418 79419 7ff7bc09e8c3 79417->79419 79420 7ff7bc0d8e90 71 API calls 79418->79420 79421 7ff7bc0d8e90 71 API calls 79419->79421 79422 7ff7bc09e622 79420->79422 79423 7ff7bc09e8e0 79421->79423 79427 7ff7bc11d350 89 API calls 5 library calls 79422->79427 79428 7ff7bc11d350 89 API calls 5 library calls 79423->79428 79426->79359 79427->79426 79428->79426 79429 7ff7bc0c1e41 79430 7ff7bc0c1e52 79429->79430 79436 7ff7bc0c1eb1 79429->79436 79431 7ff7bc095700 type_info::_name_internal_method 7 API calls 79430->79431 79432 7ff7bc0c1e6c 79431->79432 79437 7ff7bc0c6d70 93 API calls 79432->79437 79434 7ff7bc0c1e85 79438 7ff7bc0c5a10 13 API calls 2 library calls 79434->79438 79437->79434 79438->79436 79439 7ff7bc284e5c 79440 7ff7bc2813e8 std::_Lockit::_Lockit 6 API calls 79439->79440 79441 7ff7bc284e85 79440->79441 79442 7ff7bc284f47 79441->79442 79445 7ff7bc284eb6 79441->79445 79444 7ff7bc281810 Concurrency::cancel_current_task 2 API calls 79442->79444 79443 7ff7bc281460 std::_Lockit::~_Lockit LeaveCriticalSection 79446 7ff7bc284f31 79443->79446 79447 7ff7bc284f4c 79444->79447 79445->79443 79448 7ff7bc092c70 std::bad_exception::bad_exception 86 API calls 79447->79448 79449 7ff7bc284f82 79448->79449 79454 7ff7bc285028 79449->79454 79455 7ff7bc28515b 79454->79455 79457 7ff7bc29ee24 93 API calls 5 library calls 79455->79457 79458 7ff7bc0a9540 79459 7ff7bc0911a0 _Mpunct 51 API calls 79458->79459 79460 7ff7bc0a956a 79459->79460 79461 7ff7bc0d98a0 71 API calls 79460->79461 79462 7ff7bc0a957e 79461->79462 79463 7ff7bc0911a0 _Mpunct 51 API calls 79462->79463 79464 7ff7bc0a959d 79463->79464 79465 7ff7bc0d98a0 71 API calls 79464->79465 79466 7ff7bc0a95b1 79465->79466 79485 7ff7bc1317a0 ShowWindow 79466->79485 79468 7ff7bc0a95c6 79469 7ff7bc090510 67 API calls 79468->79469 79470 7ff7bc0a95d8 79469->79470 79471 7ff7bc090510 67 API calls 79470->79471 79472 7ff7bc0a95ea 79471->79472 79473 7ff7bc090510 67 API calls 79472->79473 79474 7ff7bc0a95fc 79473->79474 79475 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79474->79475 79476 7ff7bc0a9619 79475->79476 79477 7ff7bc0d8e90 71 API calls 79476->79477 79478 7ff7bc0a9636 79477->79478 79479 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79478->79479 79480 7ff7bc0a9680 79479->79480 79481 7ff7bc0d8e90 71 API calls 79480->79481 79482 7ff7bc0a969d 79481->79482 79483 7ff7bc11ca30 76 API calls 79482->79483 79484 7ff7bc0a96ee UnDecorator::getVbTableType 79483->79484 79486 7ff7bc1317ca UpdateWindow 79485->79486 79487 7ff7bc1317be 79485->79487 79486->79468 79487->79486 79488 7ff7bc0daf80 79489 7ff7bc0911a0 _Mpunct 51 API calls 79488->79489 79490 7ff7bc0dafaa 79489->79490 79491 7ff7bc0d98a0 71 API calls 79490->79491 79492 7ff7bc0dafbe 79491->79492 79493 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79492->79493 79494 7ff7bc0dafd8 79493->79494 79495 7ff7bc0d8e90 71 API calls 79494->79495 79496 7ff7bc0dafec allocator 79495->79496 79497 7ff7bc0daffb WinHttpOpen 79496->79497 79498 7ff7bc0db02d UnDecorator::getVbTableType 79497->79498 79499 7ff7bc0db058 WinHttpSetTimeouts 79498->79499 79500 7ff7bc0db040 UnDecorator::getVbTableType 79498->79500 79499->79500 79501 7ff7bc0db0c0 79502 7ff7bc0db0d8 79501->79502 79505 7ff7bc0db0df Concurrency::details::WorkQueue::IsStructuredEmpty 79501->79505 79503 7ff7bc0db1d7 WaitForSingleObject 79503->79502 79503->79505 79505->79503 79506 7ff7bc0d7740 ReleaseSRWLockExclusive 79505->79506 79508 7ff7bc0d7690 57 API calls 79505->79508 79509 7ff7bc0dab80 79505->79509 79522 7ff7bc0dbe70 79505->79522 79506->79505 79508->79505 79510 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79509->79510 79511 7ff7bc0dabaa 79510->79511 79512 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79511->79512 79513 7ff7bc0dabcf 79512->79513 79514 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79513->79514 79515 7ff7bc0dabf4 79514->79515 79516 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79515->79516 79517 7ff7bc0dac19 79516->79517 79518 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79517->79518 79519 7ff7bc0dac3e 79518->79519 79520 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79519->79520 79521 7ff7bc0dac63 79520->79521 79521->79505 79523 7ff7bc0dbeb1 allocator std::ios_base::good 79522->79523 79538 7ff7bc0dbf50 UnDecorator::getVbTableType 79522->79538 79524 7ff7bc0dbf0c WinHttpConnect 79523->79524 79525 7ff7bc0dbf57 79524->79525 79526 7ff7bc0905d0 59 API calls 79525->79526 79525->79538 79527 7ff7bc0dbf6d GetTickCount64 79526->79527 79528 7ff7bc0dc2b6 allocator std::ios_base::good 79527->79528 79529 7ff7bc09a250 69 API calls 79528->79529 79530 7ff7bc0dc387 allocator 79529->79530 79531 7ff7bc0dc392 WinHttpOpenRequest 79530->79531 79532 7ff7bc0dc3d1 WinHttpSetTimeouts 79531->79532 79536 7ff7bc0dc43c UnDecorator::getVbTableType 79531->79536 79533 7ff7bc0dc3f9 79532->79533 79532->79536 79534 7ff7bc0dc401 WinHttpCloseHandle 79533->79534 79535 7ff7bc0dc40d 79533->79535 79534->79535 79537 7ff7bc0dc415 WinHttpCloseHandle 79535->79537 79535->79538 79539 7ff7bc0dc485 79536->79539 79540 7ff7bc0dc455 WinHttpSendRequest 79536->79540 79537->79538 79538->79505 79541 7ff7bc0dc48c WinHttpReceiveResponse 79539->79541 79542 7ff7bc0dc49d 79539->79542 79540->79539 79541->79542 79543 7ff7bc0dc4a5 WinHttpCloseHandle 79542->79543 79544 7ff7bc0dc4b1 79542->79544 79543->79544 79544->79538 79545 7ff7bc0dc4b9 WinHttpCloseHandle 79544->79545 79545->79538 79546 7ff7bc0d6660 79549 7ff7bc0d1ee0 79546->79549 79552 7ff7bc0cfd80 79549->79552 79553 7ff7bc0cfd94 shared_ptr 79552->79553 79556 7ff7bc0d00a0 79553->79556 79557 7ff7bc0d00c6 _aligned_msize shared_ptr 79556->79557 79560 7ff7bc0d0010 79557->79560 79563 7ff7bc0d1bd0 79560->79563 79564 7ff7bc0d1c0a 79563->79564 79565 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79564->79565 79566 7ff7bc0d1c9a 79565->79566 79567 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79566->79567 79568 7ff7bc0d1ce7 79567->79568 79569 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79568->79569 79570 7ff7bc0d1d42 79569->79570 79571 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79570->79571 79572 7ff7bc0d1d8f 79571->79572 79573 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79572->79573 79574 7ff7bc0d1ddc 79573->79574 79577 7ff7bc0d3d10 79574->79577 79578 7ff7bc0d3d2f ctype std::_Fac_node::_Fac_node 79577->79578 79579 7ff7bc0d3d97 CoInitializeEx 79578->79579 79580 7ff7bc0911a0 _Mpunct 51 API calls 79579->79580 79581 7ff7bc0d3dca 79580->79581 79582 7ff7bc0d98a0 71 API calls 79581->79582 79583 7ff7bc0d3de4 79582->79583 79584 7ff7bc0911a0 _Mpunct 51 API calls 79583->79584 79585 7ff7bc0d3e09 79584->79585 79586 7ff7bc0d98a0 71 API calls 79585->79586 79587 7ff7bc0d3e26 79586->79587 79588 7ff7bc0905d0 59 API calls 79587->79588 79589 7ff7bc0d3e31 allocator 79588->79589 79590 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79589->79590 79591 7ff7bc0d3e6c 79590->79591 79592 7ff7bc0d8e90 71 API calls 79591->79592 79593 7ff7bc0d3e89 allocator 79592->79593 79594 7ff7bc09a250 69 API calls 79593->79594 79595 7ff7bc0d3ee4 UnDecorator::getVbTableType 79594->79595 79596 7ff7bc0911a0 _Mpunct 51 API calls 79595->79596 79597 7ff7bc0d3f21 79596->79597 79598 7ff7bc0d98a0 71 API calls 79597->79598 79599 7ff7bc0d3f3b 79598->79599 79600 7ff7bc0911a0 _Mpunct 51 API calls 79599->79600 79601 7ff7bc0d3f60 79600->79601 79602 7ff7bc0d98a0 71 API calls 79601->79602 79603 7ff7bc0d3f7d 79602->79603 79604 7ff7bc0911a0 _Mpunct 51 API calls 79603->79604 79605 7ff7bc0d3fa9 79604->79605 79606 7ff7bc0d98a0 71 API calls 79605->79606 79607 7ff7bc0d3fc6 79606->79607 79608 7ff7bc0905d0 59 API calls 79607->79608 79609 7ff7bc0d3fd8 79608->79609 79891 7ff7bc0d6ea0 51 API calls type_info::_name_internal_method 79609->79891 79611 7ff7bc0d3ffb allocator 79612 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79611->79612 79613 7ff7bc0d4060 79612->79613 79614 7ff7bc0d8e90 71 API calls 79613->79614 79615 7ff7bc0d407d allocator 79614->79615 79616 7ff7bc09a250 69 API calls 79615->79616 79617 7ff7bc0d40d9 UnDecorator::getVbTableType 79616->79617 79618 7ff7bc090510 67 API calls 79617->79618 79619 7ff7bc0d40fc 79618->79619 79620 7ff7bc090510 67 API calls 79619->79620 79621 7ff7bc0d4118 79620->79621 79622 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79621->79622 79623 7ff7bc0d4145 79622->79623 79624 7ff7bc0d8e90 71 API calls 79623->79624 79625 7ff7bc0d4162 79624->79625 79626 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79625->79626 79627 7ff7bc0d41ac 79626->79627 79628 7ff7bc0d8e90 71 API calls 79627->79628 79629 7ff7bc0d41c9 79628->79629 79630 7ff7bc11ca30 76 API calls 79629->79630 79631 7ff7bc0d4220 UnDecorator::getVbTableType 79630->79631 79632 7ff7bc0905d0 59 API calls 79631->79632 79633 7ff7bc0d4266 allocator 79632->79633 79892 7ff7bc0d6ea0 51 API calls type_info::_name_internal_method 79633->79892 79635 7ff7bc0d429e 79636 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79635->79636 79637 7ff7bc0d42eb 79636->79637 79638 7ff7bc0d8e90 71 API calls 79637->79638 79639 7ff7bc0d4308 allocator 79638->79639 79640 7ff7bc09a250 69 API calls 79639->79640 79641 7ff7bc0d4362 UnDecorator::getVbTableType 79640->79641 79642 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79641->79642 79643 7ff7bc0d43ac 79642->79643 79644 7ff7bc12db90 81 API calls 79643->79644 79645 7ff7bc0d43e1 79644->79645 79893 7ff7bc0d2880 88 API calls shared_ptr 79645->79893 79647 7ff7bc0d448e 79894 7ff7bc1095b0 79647->79894 79891->79611 79892->79635 79893->79647 79895 7ff7bc1095e1 79894->79895 80112 7ff7bc0cca20 79895->80112 79898 7ff7bc090510 67 API calls 79899 7ff7bc10961a allocator 79898->79899 80119 7ff7bc0f43b0 79899->80119 79901 7ff7bc10963e 80124 7ff7bc0ef650 79901->80124 79903 7ff7bc109775 79907 7ff7bc109793 79903->79907 79908 7ff7bc093c10 shared_ptr 47 API calls 79903->79908 79904 7ff7bc10966d 79925 7ff7bc10970d std::_Throw_Cpp_error 79904->79925 80138 7ff7bc115ad0 51 API calls shared_ptr 79904->80138 79905 7ff7bc093c10 shared_ptr 47 API calls 79905->79903 79909 7ff7bc1097a1 79907->79909 79910 7ff7bc109832 79907->79910 79908->79907 80140 7ff7bc115a70 51 API calls 79909->80140 79911 7ff7bc0905d0 59 API calls 79910->79911 79913 7ff7bc10983f 79911->79913 79916 7ff7bc0911a0 _Mpunct 51 API calls 79913->79916 79914 7ff7bc1097bc 80141 7ff7bc095040 47 API calls 2 library calls 79914->80141 79915 7ff7bc1096a7 std::_Throw_Cpp_error 79915->79925 80139 7ff7bc115ad0 51 API calls shared_ptr 79915->80139 79918 7ff7bc109864 79916->79918 79920 7ff7bc0d98a0 71 API calls 79918->79920 79919 7ff7bc1097d9 79921 7ff7bc093c10 shared_ptr 47 API calls 79919->79921 79923 7ff7bc109881 79920->79923 79924 7ff7bc1097e6 79921->79924 79926 7ff7bc090450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 79923->79926 80142 7ff7bc115a70 51 API calls 79924->80142 79925->79903 79925->79905 79929 7ff7bc1098ba 79926->79929 79928 7ff7bc109802 80143 7ff7bc095040 47 API calls 2 library calls 79928->80143 79931 7ff7bc0d8e90 71 API calls 79929->79931 79933 7ff7bc1098d7 allocator 79931->79933 79932 7ff7bc10981f 79934 7ff7bc093c10 shared_ptr 47 API calls 79932->79934 79935 7ff7bc09a250 69 API calls 79933->79935 79949 7ff7bc10982c UnDecorator::getVbTableType 79934->79949 79936 7ff7bc109921 UnDecorator::getVbTableType 79935->79936 80144 7ff7bc0dd390 49 API calls Concurrency::details::SchedulerBase::GetPolicy 79936->80144 79937 7ff7bc0911a0 _Mpunct 51 API calls 79949->79937 80115 7ff7bc0cca40 std::ios_base::good 80112->80115 80113 7ff7bc0cca9d 80116 7ff7bc093c10 shared_ptr 47 API calls 80113->80116 80115->80113 80174 7ff7bc0c62d0 RtlPcToFileHeader RaiseException strrchr std::ios_base::good 80115->80174 80175 7ff7bc0c6690 51 API calls 80115->80175 80118 7ff7bc0ccac1 80116->80118 80118->79898 80176 7ff7bc0f4fb0 80119->80176 80121 7ff7bc0f43e0 80179 7ff7bc0e7950 80121->80179 80125 7ff7bc0ef675 shared_ptr 80124->80125 80212 7ff7bc0e7850 80125->80212 80138->79915 80139->79925 80140->79914 80141->79919 80142->79928 80143->79932 80174->80115 80175->80115 80186 7ff7bc0f3b40 80176->80186 80191 7ff7bc0f3950 80179->80191 80181 7ff7bc0e799f 80197 7ff7bc0ffb00 80181->80197 80183 7ff7bc0e79aa 80209 7ff7bc0f6b20 80183->80209 80187 7ff7bc093410 std::ios_base::_Init 59 API calls 80186->80187 80188 7ff7bc0f3b5a 80187->80188 80189 7ff7bc0fe5a0 87 API calls 80188->80189 80190 7ff7bc0f3b65 80189->80190 80190->80121 80192 7ff7bc0f39c1 shared_ptr 80191->80192 80193 7ff7bc0f5220 51 API calls 80192->80193 80194 7ff7bc0f39d0 80193->80194 80195 7ff7bc0f35f0 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 80194->80195 80196 7ff7bc0f39f6 _Bitmask_includes 80195->80196 80196->80181 80198 7ff7bc0ffb23 shared_ptr 80197->80198 80199 7ff7bc0fdf30 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 80198->80199 80200 7ff7bc0ffb42 80199->80200 80201 7ff7bc0ffe90 51 API calls 80200->80201 80202 7ff7bc0ffb51 80201->80202 80203 7ff7bc0ffb74 80202->80203 80204 7ff7bc1017e0 51 API calls 80202->80204 80205 7ff7bc101420 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 80203->80205 80204->80203 80206 7ff7bc0ffb92 80205->80206 80207 7ff7bc1014d0 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 80206->80207 80208 7ff7bc0ffba3 80207->80208 80208->80183 80210 7ff7bc0f72e0 47 API calls 80209->80210 80211 7ff7bc0e79cc 80210->80211 80211->79901 80214 7ff7bc0e7878 allocator _aligned_msize List 80212->80214 80213 7ff7bc0e787f 80213->79904 80214->80213 80220 7ff7bc0f3700 51 API calls 2 library calls 80214->80220 80216 7ff7bc0e7912 80221 7ff7bc0e5510 51 API calls Concurrency::details::HardwareAffinity::operator!= 80216->80221 80218 7ff7bc0e792e 80222 7ff7bc0f69d0 47 API calls 80218->80222 80220->80216 80221->80218 80222->80213 80233 7ff7bc0eee00 80236 7ff7bc0f8c10 CoUninitialize 80233->80236 80235 7ff7bc0eee13 80236->80235

                                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                                            Function 00007FF7BC1095B0 Relevance: 88.4, APIs: 39, Strings: 11, Instructions: 865timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 0 7ff7bc1095b0-7ff7bc109672 call 7ff7bc091200 * 2 call 7ff7bc0cca20 call 7ff7bc090510 call 7ff7bc08d210 call 7ff7bc0f43b0 call 7ff7bc0f4e20 call 7ff7bc0ef650 17 7ff7bc109678-7ff7bc1096dc call 7ff7bc0f8170 call 7ff7bc115ad0 call 7ff7bc0a5cb0 0->17 18 7ff7bc109741 0->18 17->18 40 7ff7bc1096de-7ff7bc109732 call 7ff7bc0f8170 call 7ff7bc115ad0 call 7ff7bc0a5cb0 17->40 20 7ff7bc10974c-7ff7bc109761 18->20 21 7ff7bc109763-7ff7bc109775 call 7ff7bc093c10 20->21 22 7ff7bc109776-7ff7bc10977f 20->22 21->22 26 7ff7bc109781-7ff7bc109793 call 7ff7bc093c10 22->26 27 7ff7bc109794-7ff7bc10979b 22->27 26->27 31 7ff7bc1097a1-7ff7bc10982d call 7ff7bc115a70 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc115a70 call 7ff7bc095040 call 7ff7bc093c10 27->31 32 7ff7bc109832-7ff7bc109974 call 7ff7bc0905d0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc08d210 call 7ff7bc09a250 call 7ff7bc093680 call 7ff7bc0dd390 call 7ff7bc2a3da0 call 7ff7bc093680 * 2 27->32 69 7ff7bc109975-7ff7bc109a40 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc08d210 WinHttpOpen call 7ff7bc093680 31->69 32->69 40->18 62 7ff7bc109734-7ff7bc10973f 40->62 62->20 93 7ff7bc109b4d-7ff7bc109b73 WinHttpSetTimeouts 69->93 94 7ff7bc109a46-7ff7bc109b4c call 7ff7bc0911a0 call 7ff7bc0d98a0 GetLastError call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0dd3e0 call 7ff7bc2a3da0 call 7ff7bc093680 * 2 69->94 96 7ff7bc109b79-7ff7bc109c8b WinHttpCloseHandle call 7ff7bc0911a0 call 7ff7bc0d98a0 GetLastError call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0dd3e0 call 7ff7bc2a3da0 call 7ff7bc093680 * 2 93->96 97 7ff7bc109c8c-7ff7bc109cba call 7ff7bc0a3200 WinHttpConnect 93->97 94->93 96->97 105 7ff7bc109cc0-7ff7bc109dd2 WinHttpCloseHandle call 7ff7bc0911a0 call 7ff7bc0d98a0 GetLastError call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0dd3e0 call 7ff7bc2a3da0 call 7ff7bc093680 * 2 97->105 106 7ff7bc109dd3-7ff7bc109eda call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0a3200 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc08d210 WinHttpOpenRequest call 7ff7bc093680 97->106 105->106 162 7ff7bc109ffe-7ff7bc10a038 WinHttpSendRequest 106->162 163 7ff7bc109ee0-7ff7bc109ffd WinHttpCloseHandle * 2 call 7ff7bc0911a0 call 7ff7bc0d98a0 GetLastError call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0dd3e0 call 7ff7bc2a3da0 call 7ff7bc093680 * 2 106->163 166 7ff7bc10a1a8-7ff7bc10a2d0 WinHttpCloseHandle * 3 call 7ff7bc0911a0 call 7ff7bc0d98a0 GetLastError call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0dd3e0 call 7ff7bc2a3da0 call 7ff7bc093680 * 2 162->166 167 7ff7bc10a03e-7ff7bc10a04d WinHttpReceiveResponse 162->167 163->162 178 7ff7bc10a2d1-7ff7bc10a304 call 7ff7bc091680 call 7ff7bc0f42e0 166->178 167->166 169 7ff7bc10a053-7ff7bc10a09c WinHttpQueryHeaders 167->169 172 7ff7bc10a0a2-7ff7bc10a0ab GetLastError 169->172 173 7ff7bc10a1a3 169->173 172->173 177 7ff7bc10a0b1-7ff7bc10a0b6 172->177 173->178 177->173 181 7ff7bc10a0bc-7ff7bc10a14d call 7ff7bc091200 call 7ff7bc0ac710 call 7ff7bc0ac1b0 call 7ff7bc0a3200 WinHttpQueryHeaders call 7ff7bc0ac710 177->181 195 7ff7bc10a30a-7ff7bc10a389 call 7ff7bc08d210 call 7ff7bc0f41a0 call 7ff7bc0f78d0 call 7ff7bc0f9330 call 7ff7bc10e640 178->195 196 7ff7bc10a493-7ff7bc10a4bb call 7ff7bc091390 call 7ff7bc0f83c0 178->196 233 7ff7bc10a14f-7ff7bc10a194 call 7ff7bc0f45f0 call 7ff7bc0f7cb0 call 7ff7bc0d60e0 181->233 234 7ff7bc10a195-7ff7bc10a1a2 call 7ff7bc093c10 181->234 195->196 261 7ff7bc10a38f-7ff7bc10a492 WinHttpCloseHandle * 3 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0dd390 call 7ff7bc2a3da0 call 7ff7bc093680 * 2 195->261 221 7ff7bc10a4bd-7ff7bc10a4e0 call 7ff7bc0de7c0 196->221 222 7ff7bc10a4e1-7ff7bc10a4ed 196->222 221->222 229 7ff7bc10a4f2-7ff7bc10a504 call 7ff7bc0f8ed0 222->229 246 7ff7bc10a50a-7ff7bc10a524 WinHttpQueryDataAvailable 229->246 247 7ff7bc10a84b-7ff7bc10a855 229->247 233->234 234->173 252 7ff7bc10a52a-7ff7bc10a630 call 7ff7bc0911a0 call 7ff7bc0d98a0 GetLastError call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0dd3e0 call 7ff7bc2a3da0 call 7ff7bc093680 * 2 246->252 253 7ff7bc10a631-7ff7bc10a636 246->253 250 7ff7bc10a857-7ff7bc10a864 call 7ff7bc106510 247->250 251 7ff7bc10a865-7ff7bc10a952 WinHttpCloseHandle * 3 call 7ff7bc093ce0 call 7ff7bc0f9330 call 7ff7bc0b9470 call 7ff7bc093680 * 2 call 7ff7bc0f71a0 call 7ff7bc0f6f70 call 7ff7bc093680 call 7ff7bc093c10 * 3 call 7ff7bc093ce0 * 2 247->251 250->251 252->253 259 7ff7bc10a638-7ff7bc10a63d 253->259 260 7ff7bc10a642-7ff7bc10a6c4 call 7ff7bc0bbc10 call 7ff7bc112b60 call 7ff7bc112c10 call 7ff7bc115190 call 7ff7bc0a2900 WinHttpReadData 253->260 259->247 308 7ff7bc10a6ca-7ff7bc10a6d4 260->308 309 7ff7bc10a83f-7ff7bc10a844 260->309 261->196 313 7ff7bc10a6da-7ff7bc10a72b call 7ff7bc0a2900 call 7ff7bc1174d0 call 7ff7bc0f83c0 308->313 314 7ff7bc10a770-7ff7bc10a846 call 7ff7bc091200 call 7ff7bc0bf420 call 7ff7bc0bb5c0 call 7ff7bc0ea240 call 7ff7bc0a3200 call 7ff7bc1174d0 call 7ff7bc093c10 308->314 309->247 313->314 340 7ff7bc10a72d-7ff7bc10a736 313->340 314->229 340->314 344 7ff7bc10a738-7ff7bc10a76f call 7ff7bc0f8e40 340->344 344->314
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Http$CloseHandle$Concurrency::details::EmptyErrorLastQueue::StructuredWork$shared_ptr$Query$Concurrency::details::_CriticalDataHeadersLock::_OpenReentrantRequestScoped_lockScoped_lock::~_type_info::_name_internal_method$AvailableChar_traitsConnectDecorator::getExceptionFileHeaderListRaiseReadReceiveResponseSafeSendTableTimeoutsType
                                                                                                                                                                                                                            • String ID: GET$URL format is not valid : %ws$WinHTTP 1.0$^(https?://(?:www.)?([^/]+))(/.*)?$$file creation failure$handle connection failure$handle initialization failure$handle request creation failure$handle request or response failure$query data not available$timeout init failure
                                                                                                                                                                                                                            • API String ID: 5397687-202491335
                                                                                                                                                                                                                            • Opcode ID: dfc935871b3932ad679c7a19cd0f7e93ccd8b685acfe70352a6c5eebc06737a2
                                                                                                                                                                                                                            • Instruction ID: 437370bc75bc8673851168df993357123a7f7b9bb3b71a18be317ee794571642
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dfc935871b3932ad679c7a19cd0f7e93ccd8b685acfe70352a6c5eebc06737a2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 77A2EB7260DAC295E670AB18E8903EBB364FBD6740F808136D78D83AADDF6CD545CB50
                                                                                                                                                                                                                            Function 00007FF7BC0EBFE0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 210libraryloaderCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2509 7ff7bc0ebfe0-7ff7bc0ec003 2510 7ff7bc0ec005-7ff7bc0ec04d call 7ff7bc092a70 2509->2510 2511 7ff7bc0ec052-7ff7bc0ec09a call 7ff7bc0eef00 2509->2511 2518 7ff7bc0ec41c-7ff7bc0ec423 2510->2518 2517 7ff7bc0ec0a4-7ff7bc0ec0d1 call 7ff7bc092a70 call 7ff7bc0b0720 * 2 2511->2517 2525 7ff7bc0ec17c-7ff7bc0ec188 call 7ff7bc0b0720 2517->2525 2526 7ff7bc0ec0d7-7ff7bc0ec0fd LoadLibraryW GetProcAddress 2517->2526 2532 7ff7bc0ec1a6-7ff7bc0ec209 call 7ff7bc0f4790 call 7ff7bc1120d0 call 7ff7bc2d387c call 7ff7bc08bc20 * 2 call 7ff7bc0de190 2525->2532 2533 7ff7bc0ec18a-7ff7bc0ec1a1 call 7ff7bc092a70 2525->2533 2527 7ff7bc0ec0ff-7ff7bc0ec115 2526->2527 2528 7ff7bc0ec11a-7ff7bc0ec178 call 7ff7bc092a70 2526->2528 2527->2518 2528->2525 2551 7ff7bc0ec212-7ff7bc0ec232 call 7ff7bc112fb0 2532->2551 2533->2518 2554 7ff7bc0ec3de-7ff7bc0ec414 call 7ff7bc08d210 call 7ff7bc2d3882 call 7ff7bc093c10 call 7ff7bc0f7010 2551->2554 2555 7ff7bc0ec238-7ff7bc0ec2a8 call 7ff7bc0ac710 call 7ff7bc097170 call 7ff7bc0a3200 LoadLibraryW call 7ff7bc0902f0 call 7ff7bc0aa8b0 call 7ff7bc0ac710 call 7ff7bc0f8400 2551->2555 2554->2518 2578 7ff7bc0ec2ba-7ff7bc0ec2de call 7ff7bc08d210 GetProcAddress 2555->2578 2579 7ff7bc0ec2aa-7ff7bc0ec2b5 call 7ff7bc0f7090 2555->2579 2584 7ff7bc0ec2f0-7ff7bc0ec348 call 7ff7bc0f4790 call 7ff7bc1120d0 2578->2584 2585 7ff7bc0ec2e0-7ff7bc0ec2eb call 7ff7bc0f7090 2578->2585 2579->2551 2593 7ff7bc0ec364-7ff7bc0ec3c2 call 7ff7bc0abcd0 call 7ff7bc107f50 call 7ff7bc092a70 call 7ff7bc0f7010 call 7ff7bc0f7090 call 7ff7bc093c10 call 7ff7bc0f7010 2584->2593 2594 7ff7bc0ec34a-7ff7bc0ec35f call 7ff7bc0f7010 call 7ff7bc0f7090 2584->2594 2585->2551 2593->2518 2594->2551
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: atomic$AddressLibraryLoadProc
                                                                                                                                                                                                                            • String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$combase.dll
                                                                                                                                                                                                                            • API String ID: 1653574484-4170001172
                                                                                                                                                                                                                            • Opcode ID: 8fab117c1cdc8e3682f0ec68a2ac1de93d45519c69ca58d2309001f4c9a9c856
                                                                                                                                                                                                                            • Instruction ID: b99d1b4b212ea864cf4ea21f0a015ef1c5ca43e7f6f02f225b3b5c6cc0679a7e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8fab117c1cdc8e3682f0ec68a2ac1de93d45519c69ca58d2309001f4c9a9c856
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4EB1E23294CA8681D660FB19E8513FEE364FBA6790F808135E78D43AAEDF2CD545CB50
                                                                                                                                                                                                                            Function 00007FF7BC131860 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 59memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: GlobalResource$LockName$AllocCreateErrorFindLastLoadNodeNode::SizeofStreamUnlock
                                                                                                                                                                                                                            • String ID: &$PNG
                                                                                                                                                                                                                            • API String ID: 404809873-3047161795
                                                                                                                                                                                                                            • Opcode ID: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
                                                                                                                                                                                                                            • Instruction ID: abb1ca829ba5abe60738af9ac489eba84204f30b55fed1d27b5094523f6cd865
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D231E876608B8686D760AB19F48436AB7B0FBD9B94F508035EB8E43B6CDF3CD1448B14
                                                                                                                                                                                                                            Function 00007FF7BC098790 Relevance: 18.0, APIs: 2, Strings: 8, Instructions: 500COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 3567 7ff7bc098790-7ff7bc0989c3 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0905d0 call 7ff7bc13b750 3612 7ff7bc0989c9-7ff7bc098bd6 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090510 * 3 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc11d350 call 7ff7bc093680 * 7 call 7ff7bc093c10 * 4 3567->3612 3613 7ff7bc098bdb-7ff7bc098be5 call 7ff7bc10e480 3567->3613 3754 7ff7bc099315-7ff7bc09931c 3612->3754 3618 7ff7bc098e18-7ff7bc098fa0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc2d4170 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0f9c90 3613->3618 3619 7ff7bc098beb-7ff7bc098e13 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090510 * 3 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc11d350 call 7ff7bc093680 * 7 call 7ff7bc093c10 * 4 3613->3619 3680 7ff7bc098fa5-7ff7bc098fc9 call 7ff7bc093680 * 2 3618->3680 3619->3754 3693 7ff7bc099032-7ff7bc099310 GetLastError FormatMessageW call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc09a250 call 7ff7bc093680 call 7ff7bc09ae30 * 2 call 7ff7bc090510 * 2 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc11d350 call 7ff7bc093680 * 7 call 7ff7bc093c10 * 4 3680->3693 3694 7ff7bc098fcb-7ff7bc09902d call 7ff7bc093680 * 3 call 7ff7bc093c10 * 4 3680->3694 3693->3754 3694->3754
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsConcurrency::details::_CriticalDecorator::getHandleLock::_ReentrantScoped_lockScoped_lock::~_TableTypetype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: .\nwjs\NW_store.exe$.\ui\.$UI StartedMain process ID:%d$creation_error=%ws$directory_switching_error$product$ui_creation_failed$ui_termination_error
                                                                                                                                                                                                                            • API String ID: 1646997740-2964731665
                                                                                                                                                                                                                            • Opcode ID: 58715a0bb56de5ae72901dd4a4cf3f76758f7ce8fc64a83df06aa810346db990
                                                                                                                                                                                                                            • Instruction ID: dd65aba050517f8378f539b695fbbb06b68aa17995f0db29e3ed3a6cfcc1a13f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 58715a0bb56de5ae72901dd4a4cf3f76758f7ce8fc64a83df06aa810346db990
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5442EA3264DAC291DA71AB58E8903EBB364FBD6740F809532D78C82B6EDF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC2D1274 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1617910340-0
                                                                                                                                                                                                                            • Opcode ID: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
                                                                                                                                                                                                                            • Instruction ID: dec7decb4c8baa15f8c5afdad524f7b76f14cded09487d0ca633f769a042fcad
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8DC1C237B28A4285EB10EF69C4916EC7761F76ABA8B448225DB2E977DCCF39D051C310
                                                                                                                                                                                                                            Function 00007FF7BC115130 Relevance: 3.0, APIs: 2, Instructions: 14keyboardCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: keybd_event
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2665452162-0
                                                                                                                                                                                                                            • Opcode ID: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
                                                                                                                                                                                                                            • Instruction ID: a110954d7f4878f02005137901ed8f2631093604d2ebea5b0424070657bcbd09
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 48D0C974B1106342E7A03B617C6AFD50FA06B6ABC9FA2F420CA041BB40CD1A12490774
                                                                                                                                                                                                                            Function 00007FF7BC0A6570 Relevance: 54.4, APIs: 15, Strings: 15, Instructions: 1912COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 360 7ff7bc0a6570-7ff7bc0a6db1 call 7ff7bc2a2f90 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 511 7ff7bc0a6f10-7ff7bc0a6fc9 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 360->511 512 7ff7bc0a6db7-7ff7bc0a6e38 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0fa800 call 7ff7bc093680 360->512 546 7ff7bc0a6fd0-7ff7bc0a70d9 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 511->546 530 7ff7bc0a6e48-7ff7bc0a6e4f 512->530 531 7ff7bc0a6e3a-7ff7bc0a6e46 512->531 533 7ff7bc0a6e54-7ff7bc0a6f0b call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 530->533 531->533 533->546 567 7ff7bc0a70df-7ff7bc0a71e5 call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 546->567 568 7ff7bc0a7203-7ff7bc0a72bc call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 546->568 609 7ff7bc0a71e7-7ff7bc0a71ec 567->609 610 7ff7bc0a71ee 567->610 601 7ff7bc0a72c3-7ff7bc0a73cc call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 568->601 619 7ff7bc0a73d2-7ff7bc0a74d8 call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 601->619 620 7ff7bc0a74f6-7ff7bc0a75af call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 601->620 612 7ff7bc0a71f3-7ff7bc0a71fe 609->612 610->612 612->601 661 7ff7bc0a74e1 619->661 662 7ff7bc0a74da-7ff7bc0a74df 619->662 654 7ff7bc0a75b6-7ff7bc0a76bf call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 620->654 671 7ff7bc0a77e2-7ff7bc0a789b call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 654->671 672 7ff7bc0a76c5-7ff7bc0a77cb call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 654->672 664 7ff7bc0a74e6-7ff7bc0a74f1 661->664 662->664 664->654 706 7ff7bc0a78a2-7ff7bc0a79ab call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 671->706 714 7ff7bc0a77d6 672->714 715 7ff7bc0a77cd-7ff7bc0a77d4 672->715 723 7ff7bc0a79b1-7ff7bc0a7ab7 call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 706->723 724 7ff7bc0a7adb-7ff7bc0a7b94 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 706->724 717 7ff7bc0a77dd 714->717 715->717 717->706 766 7ff7bc0a7ac3 723->766 767 7ff7bc0a7ab9-7ff7bc0a7ac1 723->767 757 7ff7bc0a7b9b-7ff7bc0a7ca4 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 724->757 775 7ff7bc0a7caa-7ff7bc0a7db0 call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 757->775 776 7ff7bc0a7dce-7ff7bc0a7e87 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 757->776 769 7ff7bc0a7acb-7ff7bc0a7ad6 766->769 767->769 769->757 817 7ff7bc0a7db2-7ff7bc0a7db7 775->817 818 7ff7bc0a7db9 775->818 809 7ff7bc0a7e8e-7ff7bc0a7f97 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 776->809 827 7ff7bc0a80c1-7ff7bc0a817a call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 809->827 828 7ff7bc0a7f9d-7ff7bc0a80a3 call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 809->828 820 7ff7bc0a7dbe-7ff7bc0a7dc9 817->820 818->820 820->809 862 7ff7bc0a8181-7ff7bc0a828a call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 827->862 869 7ff7bc0a80a5-7ff7bc0a80aa 828->869 870 7ff7bc0a80ac 828->870 879 7ff7bc0a8290-7ff7bc0a8396 call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 862->879 880 7ff7bc0a83b4-7ff7bc0a846d call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 862->880 872 7ff7bc0a80b1-7ff7bc0a80bc 869->872 870->872 872->862 922 7ff7bc0a839f 879->922 923 7ff7bc0a8398-7ff7bc0a839d 879->923 914 7ff7bc0a8474-7ff7bc0a857d call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 880->914 931 7ff7bc0a8583-7ff7bc0a8689 call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 914->931 932 7ff7bc0a86ad-7ff7bc0a8766 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 914->932 925 7ff7bc0a83a4-7ff7bc0a83af 922->925 923->925 925->914 974 7ff7bc0a8695 931->974 975 7ff7bc0a868b-7ff7bc0a8693 931->975 965 7ff7bc0a876d-7ff7bc0a8876 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 932->965 983 7ff7bc0a89a0-7ff7bc0a8a59 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 965->983 984 7ff7bc0a887c-7ff7bc0a8982 call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 965->984 977 7ff7bc0a869d-7ff7bc0a86a8 974->977 975->977 977->965 1017 7ff7bc0a8a60-7ff7bc0a8b69 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 983->1017 1025 7ff7bc0a8984-7ff7bc0a8989 984->1025 1026 7ff7bc0a898b 984->1026 1035 7ff7bc0a8b6f-7ff7bc0a8c75 call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 1017->1035 1036 7ff7bc0a8c93-7ff7bc0a8d4c call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 1017->1036 1028 7ff7bc0a8990-7ff7bc0a899b 1025->1028 1026->1028 1028->1017 1077 7ff7bc0a8c77-7ff7bc0a8c7c 1035->1077 1078 7ff7bc0a8c7e 1035->1078 1070 7ff7bc0a8d53-7ff7bc0a8e5c call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 1036->1070 1087 7ff7bc0a8e62-7ff7bc0a8ee3 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0fa800 call 7ff7bc093680 1070->1087 1088 7ff7bc0a8fbb-7ff7bc0a9074 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 1070->1088 1080 7ff7bc0a8c83-7ff7bc0a8c8e 1077->1080 1078->1080 1080->1070 1106 7ff7bc0a8ee5-7ff7bc0a8ef1 1087->1106 1107 7ff7bc0a8ef3-7ff7bc0a8efa 1087->1107 1122 7ff7bc0a907b-7ff7bc0a9184 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 1088->1122 1109 7ff7bc0a8eff-7ff7bc0a8fb6 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 1106->1109 1107->1109 1109->1122 1143 7ff7bc0a9290-7ff7bc0a9348 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 1122->1143 1144 7ff7bc0a918a-7ff7bc0a928b call 7ff7bc0b04f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095040 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 1122->1144 1177 7ff7bc0a9349-7ff7bc0a9425 call 7ff7bc093680 * 2 call 7ff7bc093c10 * 13 1143->1177 1144->1177
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCreateKeyW.ADVAPI32 ref: 00007FF7BC112347
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegQueryValueExW.ADVAPI32 ref: 00007FF7BC112392
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCloseKey.ADVAPI32 ref: 00007FF7BC1123A1
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A6FA7
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0FA800: std::ios_base::good.LIBCPMTD ref: 00007FF7BC0FA9E1
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A6EE9
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A729A
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A758D
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A7879
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCloseKey.ADVAPI32 ref: 00007FF7BC1123CD
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A7E65
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A8158
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A844B
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A8744
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A8A37
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A8D2A
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A8F94
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A9052
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A7B72
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC095040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC09506B
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC095040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC09507A
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0A9327
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: type_info::_name_internal_method$Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Close$Char_traitsCreateQueryValuestd::ios_base::good
                                                                                                                                                                                                                            • String ID: PCAppStore$PCAppStoreUpdater$auto_start_on$browser_activity$browser_search$btn_x_close$contextual_offers$hardware_collecting$link_substitution$periodical_offers$personilized_notifications$search_menu$should_auto_update$software_collecting$start_menu_on
                                                                                                                                                                                                                            • API String ID: 2434849288-4189071652
                                                                                                                                                                                                                            • Opcode ID: a57e0a829b0c5b3e38cfaa5ca802cc46ff19b3d1bc229ad3d246ec2f24c19313
                                                                                                                                                                                                                            • Instruction ID: 105b710937bd590c656f55b01fbdbde95763eef072c13333f936263db27af150
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a57e0a829b0c5b3e38cfaa5ca802cc46ff19b3d1bc229ad3d246ec2f24c19313
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9133B53260DAC294DA70AB19E8902EBB3A4FBD6740F809136D78D43B6EDF6CD554CB50
                                                                                                                                                                                                                            Function 00007FF7BC09B130 Relevance: 47.9, APIs: 13, Strings: 14, Instructions: 636registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1212 7ff7bc09b130-7ff7bc09b23b call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc08d210 call 7ff7bc093680 RegisterClassExW 1225 7ff7bc09b24d-7ff7bc09b348 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc08d210 CreateWindowExW call 7ff7bc093680 1212->1225 1226 7ff7bc09b23d-7ff7bc09b248 call 7ff7bc093680 1212->1226 1238 7ff7bc09b35a-7ff7bc09b5ba ShowWindow call 7ff7bc2a2956 call 7ff7bc091200 call 7ff7bc0ac710 call 7ff7bc0ac1b0 call 7ff7bc091200 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc095950 call 7ff7bc095880 call 7ff7bc093680 * 3 1225->1238 1239 7ff7bc09b34a-7ff7bc09b355 call 7ff7bc093680 1225->1239 1231 7ff7bc09c03b-7ff7bc09c043 1226->1231 1278 7ff7bc09b5bb-7ff7bc09b5cc 1238->1278 1239->1231 1279 7ff7bc09b5d2-7ff7bc09b633 call 7ff7bc0950c0 GetForegroundWindow call 7ff7bc0a3200 GetWindowTextW call 7ff7bc0a60e0 1278->1279 1280 7ff7bc09bfd8-7ff7bc09c03a call 7ff7bc2a295c call 7ff7bc093680 * 3 call 7ff7bc093c10 * 2 call 7ff7bc093680 1278->1280 1294 7ff7bc09b662-7ff7bc09b68c PeekMessageW 1279->1294 1295 7ff7bc09b635-7ff7bc09b64e call 7ff7bc0a60e0 1279->1295 1280->1231 1298 7ff7bc09b692-7ff7bc09b6ba TranslateMessage DispatchMessageW 1294->1298 1299 7ff7bc09be21-7ff7bc09be2c Sleep 1294->1299 1295->1294 1306 7ff7bc09b650-7ff7bc09b659 1295->1306 1303 7ff7bc09b6c0-7ff7bc09ba68 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090510 * 2 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11d350 call 7ff7bc093680 * 5 call 7ff7bc0ad500 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0a3b30 call 7ff7bc093680 * 5 1298->1303 1304 7ff7bc09ba6d-7ff7bc09ba78 1298->1304 1302 7ff7bc09be2d-7ff7bc09be36 1299->1302 1307 7ff7bc09be51-7ff7bc09be7c call 7ff7bc08d210 OpenEventW 1302->1307 1308 7ff7bc09be38 1302->1308 1309 7ff7bc09be1f 1303->1309 1304->1309 1310 7ff7bc09ba7e-7ff7bc09be1e call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090510 * 2 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11d350 call 7ff7bc093680 * 5 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0a3b30 call 7ff7bc093680 * 5 1304->1310 1306->1294 1314 7ff7bc09b65b 1306->1314 1323 7ff7bc09be82-7ff7bc09be94 WaitForSingleObject 1307->1323 1324 7ff7bc09bfd3 1307->1324 1315 7ff7bc09be38 call 7ff7bc0fab70 1308->1315 1309->1302 1310->1309 1314->1294 1320 7ff7bc09be3d-7ff7bc09be42 1315->1320 1326 7ff7bc09be44 call 7ff7bc115130 1320->1326 1327 7ff7bc09be4a 1320->1327 1323->1324 1330 7ff7bc09be9a-7ff7bc09bfd2 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc12db90 CloseHandle call 7ff7bc093c10 1323->1330 1324->1278 1337 7ff7bc09be49 1326->1337 1327->1307 1330->1324 1337->1327
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                            • RegisterClassExW.USER32 ref: 00007FF7BC09B230
                                                                                                                                                                                                                            • CreateWindowExW.USER32 ref: 00007FF7BC09B31B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsClassCreateRegisterWindowtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: ENDING_EVT_HANDLER$Local$P$PCAppStore$Windows Default Lock Screen$logoff$msg=logoff$msg=shutdown$product$product$shutdown$system_event$system_event${"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}
                                                                                                                                                                                                                            • API String ID: 331722943-4236414880
                                                                                                                                                                                                                            • Opcode ID: eb69007c441df4b8ad8ad3d4b2f943f6707917c7c4c23ba9b28496f7bd644259
                                                                                                                                                                                                                            • Instruction ID: 516c9123dda60087b7895b5a6f40931fc43357f2ed3e6bfd6609d08e0ec5e56b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb69007c441df4b8ad8ad3d4b2f943f6707917c7c4c23ba9b28496f7bd644259
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C72C47260DAC291EA70AB18E8903EAB364FBD6750F809136D78D43BADDF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC242C40 Relevance: 35.9, APIs: 10, Strings: 10, Instructions: 897COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1467 7ff7bc242c40-7ff7bc243138 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0913f0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112420 call 7ff7bc08d210 call 7ff7bc2a9110 1554 7ff7bc24313a-7ff7bc243149 1467->1554 1555 7ff7bc24314b-7ff7bc243152 1467->1555 1556 7ff7bc24315a-7ff7bc24334d call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc09a530 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 * 2 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112420 call 7ff7bc08d210 call 7ff7bc2a9110 1554->1556 1555->1556 1589 7ff7bc243359 1556->1589 1590 7ff7bc24334f-7ff7bc243357 1556->1590 1591 7ff7bc243361-7ff7bc2434a5 call 7ff7bc093680 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112420 call 7ff7bc08d210 call 7ff7bc2a9110 1589->1591 1590->1591 1608 7ff7bc2434a7-7ff7bc2434af 1591->1608 1609 7ff7bc2434b1 1591->1609 1610 7ff7bc2434b9-7ff7bc2435fd call 7ff7bc093680 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112420 call 7ff7bc08d210 call 7ff7bc2a9110 1608->1610 1609->1610 1627 7ff7bc243609 1610->1627 1628 7ff7bc2435ff-7ff7bc243607 1610->1628 1629 7ff7bc243611-7ff7bc24362c call 7ff7bc093680 1627->1629 1628->1629 1632 7ff7bc24362e-7ff7bc24363d 1629->1632 1633 7ff7bc24363f-7ff7bc243646 1629->1633 1634 7ff7bc24364e-7ff7bc24370a call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc09a530 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 1632->1634 1633->1634 1651 7ff7bc24371d-7ff7bc243724 1634->1651 1652 7ff7bc24370c-7ff7bc24371b 1634->1652 1653 7ff7bc24372c-7ff7bc2437e8 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc09a530 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 1651->1653 1652->1653 1670 7ff7bc2437ea-7ff7bc2437f9 1653->1670 1671 7ff7bc2437fb-7ff7bc243802 1653->1671 1672 7ff7bc24380a-7ff7bc2438cc call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc09a530 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 1670->1672 1671->1672 1689 7ff7bc243bf9-7ff7bc243d6e call 7ff7bc090c10 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 call 7ff7bc0954e0 call 7ff7bc0952b0 call 7ff7bc0b0350 call 7ff7bc0aa8b0 1672->1689 1690 7ff7bc2438d2-7ff7bc243aef call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc112310 1672->1690 1732 7ff7bc243e05-7ff7bc243e16 call 7ff7bc0aa8b0 1689->1732 1733 7ff7bc243d74-7ff7bc243d9d call 7ff7bc0aa8b0 1689->1733 1769 7ff7bc243af8 1690->1769 1770 7ff7bc243af1-7ff7bc243af6 1690->1770 1741 7ff7bc243e1c-7ff7bc243f00 call 7ff7bc08bc20 call 7ff7bc0a5ce0 call 7ff7bc0a3140 call 7ff7bc095830 call 7ff7bc0897a0 call 7ff7bc095040 call 7ff7bc093c10 1732->1741 1742 7ff7bc243f01-7ff7bc2440c5 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc09a530 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc0950c0 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc0905d0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc2415d0 * 2 call 7ff7bc2415a0 call 7ff7bc2415d0 call 7ff7bc089ef0 call 7ff7bc2415d0 call 7ff7bc093680 1732->1742 1743 7ff7bc243dac-7ff7bc243db9 1733->1743 1741->1742 1833 7ff7bc2440c7-7ff7bc2440cf 1742->1833 1834 7ff7bc2440d1 1742->1834 1747 7ff7bc243dbb-7ff7bc243dfe call 7ff7bc0a3140 call 7ff7bc0a9be0 1743->1747 1748 7ff7bc243e00 1743->1748 1747->1743 1748->1742 1774 7ff7bc243afd-7ff7bc243b04 1769->1774 1770->1774 1778 7ff7bc243b17-7ff7bc243b1e 1774->1778 1779 7ff7bc243b06-7ff7bc243b15 1774->1779 1780 7ff7bc243b26-7ff7bc243bf8 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc0956a0 call 7ff7bc095160 call 7ff7bc093c10 call 7ff7bc093680 call 7ff7bc093c10 * 2 1778->1780 1779->1780 1780->1689 1835 7ff7bc2440d9-7ff7bc244202 call 7ff7bc1326a0 call 7ff7bc090450 call 7ff7bc12db90 call 7ff7bc093680 call 7ff7bc093c10 call 7ff7bc097240 call 7ff7bc093d60 call 7ff7bc093c10 * 7 1833->1835 1834->1835
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112420: RegCreateKeyW.ADVAPI32 ref: 00007FF7BC112470
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112420: strrchr.LIBCMTD ref: 00007FF7BC112487
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112420: RegQueryValueExW.ADVAPI32 ref: 00007FF7BC1124D3
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112420: RegCloseKey.ADVAPI32 ref: 00007FF7BC1124ED
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC2431EF
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC2436E3
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC2437C1
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC243BBB
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC24389F
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCreateKeyW.ADVAPI32 ref: 00007FF7BC112347
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegQueryValueExW.ADVAPI32 ref: 00007FF7BC112392
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCloseKey.ADVAPI32 ref: 00007FF7BC1123A1
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC244039
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC244048
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC244065
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC244074
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC244090
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: type_info::_name_internal_method$Decorator::getTableType$Concurrency::details::EmptyQueue::StructuredWork$CloseCreateQueryValue$Char_traitsshared_ptrstrrchr
                                                                                                                                                                                                                            • String ID: ColorPrevalence$ColorizationColor$EnableTransparency$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Themes\Personalize$Software\Microsoft\Windows\DWM$SystemUsesLightTheme$TaskbarAl$theme_parameter${"app" : {
                                                                                                                                                                                                                            • API String ID: 3722789660-4154301006
                                                                                                                                                                                                                            • Opcode ID: e75f46a8d36983b77a2a4588e6f03f2aa8e8b20020b9681ebdb5b1361a741448
                                                                                                                                                                                                                            • Instruction ID: 84e3daa58df0e911045e57c4f8860c1c67c07afaaeaf40e8a3feab19e4e7a3fe
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e75f46a8d36983b77a2a4588e6f03f2aa8e8b20020b9681ebdb5b1361a741448
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8BB2E57260DAC295DAB0AB09E8803EBB3A4EBD5740F809136D78D43B6DEF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC09C290 Relevance: 34.6, APIs: 6, Strings: 13, Instructions: 1383COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1864 7ff7bc09c290-7ff7bc09c718 call 7ff7bc2a2f90 call 7ff7bc0aa0d0 call 7ff7bc0ad500 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0905d0 call 7ff7bc0fa6b0 call 7ff7bc08d210 * 2 call 7ff7bc09a250 call 7ff7bc093680 call 7ff7bc090510 * 2 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11ca30 call 7ff7bc093680 * 4 call 7ff7bc088ad0 call 7ff7bc0a48d0 call 7ff7bc098790 1945 7ff7bc09c809-7ff7bc09c818 call 7ff7bc112f10 call 7ff7bc0ab220 1864->1945 1946 7ff7bc09c71e-7ff7bc09c804 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0a3b30 call 7ff7bc093680 call 7ff7bc094e10 call 7ff7bc093680 * 2 call 7ff7bc093c10 call 7ff7bc093680 * 5 1864->1946 1955 7ff7bc09c819-7ff7bc09c82c call 7ff7bc12e340 1945->1955 2034 7ff7bc09e29b-7ff7bc09e2a2 1946->2034 1961 7ff7bc09c832-7ff7bc09c843 1955->1961 1962 7ff7bc09ca43-7ff7bc09ca6e call 7ff7bc0acdd0 call 7ff7bc0a97e0 call 7ff7bc0ab220 1955->1962 1961->1962 1965 7ff7bc09c849-7ff7bc09c891 call 7ff7bc0ab220 call 7ff7bc08a520 call 7ff7bc089a20 call 7ff7bc0a4400 1961->1965 1983 7ff7bc09ca73-7ff7bc09ca86 call 7ff7bc12d2d0 1962->1983 1991 7ff7bc09ca11-7ff7bc09ca38 call 7ff7bc12d390 call 7ff7bc097d40 call 7ff7bc08fed0 1965->1991 1992 7ff7bc09c897-7ff7bc09ca0c call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0a3340 call 7ff7bc093680 call 7ff7bc112f10 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0a3b30 call 7ff7bc093680 call 7ff7bc0abd30 call 7ff7bc094e10 call 7ff7bc093680 * 2 call 7ff7bc093c10 call 7ff7bc093680 * 5 1965->1992 1994 7ff7bc09ca8c-7ff7bc09ca9d 1983->1994 1995 7ff7bc09cc8b-7ff7bc09cf0d call 7ff7bc0902f0 call 7ff7bc0893b0 call 7ff7bc26f450 call 7ff7bc26f480 call 7ff7bc090510 * 3 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11ca30 call 7ff7bc093680 * 5 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc12db90 1983->1995 2025 7ff7bc09ca3d-7ff7bc09ca3e 1991->2025 1992->2034 1994->1995 2000 7ff7bc09caa3-7ff7bc09caeb call 7ff7bc0ab220 call 7ff7bc08a520 call 7ff7bc089a20 call 7ff7bc0a4400 1994->2000 2135 7ff7bc09cf0f-7ff7bc09cf78 call 7ff7bc094e10 call 7ff7bc093680 * 2 call 7ff7bc093c10 call 7ff7bc093680 * 5 1995->2135 2136 7ff7bc09cf7d-7ff7bc09d513 call 7ff7bc08d210 call 7ff7bc0c01e0 call 7ff7bc08bc20 call 7ff7bc14a2b0 call 7ff7bc094730 call 7ff7bc08d210 call 7ff7bc0c1a90 call 7ff7bc08bc20 call 7ff7bc14a0c0 call 7ff7bc094730 call 7ff7bc08d210 * 2 call 7ff7bc12a070 call 7ff7bc08bc20 call 7ff7bc14a0c0 call 7ff7bc094730 call 7ff7bc08d210 call 7ff7bc12fd90 call 7ff7bc08bc20 call 7ff7bc14a2b0 call 7ff7bc094730 call 7ff7bc08d210 * 2 call 7ff7bc1338c0 call 7ff7bc08bc20 call 7ff7bc14a160 call 7ff7bc094730 call 7ff7bc08d210 * 2 call 7ff7bc138be0 call 7ff7bc08bc20 call 7ff7bc14a2b0 call 7ff7bc094730 call 7ff7bc08d210 call 7ff7bc139bc0 call 7ff7bc08bc20 call 7ff7bc14a2b0 call 7ff7bc094730 call 7ff7bc08d210 call 7ff7bc13ff90 call 7ff7bc08bc20 call 7ff7bc14a2b0 call 7ff7bc094730 call 7ff7bc08d210 * 2 call 7ff7bc14ea80 call 7ff7bc08bc20 call 7ff7bc14a160 call 7ff7bc094730 1995->2136 2038 7ff7bc09caf1-7ff7bc09cc66 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0a3340 call 7ff7bc093680 call 7ff7bc112f10 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0a3b30 call 7ff7bc093680 call 7ff7bc0abd30 call 7ff7bc094e10 call 7ff7bc093680 * 2 call 7ff7bc093c10 call 7ff7bc093680 * 5 2000->2038 2039 7ff7bc09cc6b-7ff7bc09cc86 call 7ff7bc097d40 call 7ff7bc08fed0 2000->2039 2025->1955 2038->2034 2039->1983 2135->2034 2260 7ff7bc09d515-7ff7bc09d523 call 7ff7bc0a9dd0 2136->2260 2261 7ff7bc09d528-7ff7bc09d574 call 7ff7bc08d210 * 2 call 7ff7bc23f510 2136->2261 2266 7ff7bc09d5ca-7ff7bc09d96d call 7ff7bc08d210 * 2 call 7ff7bc23cd30 call 7ff7bc08bc20 call 7ff7bc14a0c0 call 7ff7bc094730 call 7ff7bc08d210 * 2 call 7ff7bc244210 call 7ff7bc08bc20 call 7ff7bc14a160 call 7ff7bc094730 call 7ff7bc08d210 * 2 call 7ff7bc252560 call 7ff7bc08bc20 call 7ff7bc14a2b0 call 7ff7bc094730 call 7ff7bc08d210 call 7ff7bc255180 call 7ff7bc08bc20 call 7ff7bc14a2b0 call 7ff7bc094730 call 7ff7bc08d210 call 7ff7bc14ab80 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc253e60 call 7ff7bc088ad0 call 7ff7bc0a48d0 call 7ff7bc088ad0 2260->2266 2273 7ff7bc09d579-7ff7bc09d5c9 call 7ff7bc08bc20 call 7ff7bc14a0c0 call 7ff7bc094730 2261->2273 2344 7ff7bc09d972-7ff7bc09da53 call 7ff7bc0a48d0 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc12db90 WaitForSingleObject call 7ff7bc26f4d0 2266->2344 2273->2266 2355 7ff7bc09e1a5-7ff7bc09e1f8 call 7ff7bc12d420 call 7ff7bc112f10 call 7ff7bc0a62c0 ResetEvent 2344->2355 2356 7ff7bc09da59-7ff7bc09da75 WaitForSingleObject 2344->2356 2371 7ff7bc09e208-7ff7bc09e29a call 7ff7bc094e10 * 2 call 7ff7bc093c10 call 7ff7bc094e10 call 7ff7bc093680 * 2 call 7ff7bc093c10 call 7ff7bc093680 * 5 2355->2371 2372 7ff7bc09e1fa-7ff7bc09e207 call 7ff7bc0abd30 2355->2372 2358 7ff7bc09e180-7ff7bc09e1a4 CloseHandle * 2 2356->2358 2359 7ff7bc09da7b-7ff7bc09dd19 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc090510 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11cb80 call 7ff7bc13b750 2356->2359 2358->2355 2425 7ff7bc09df40-7ff7bc09df45 2359->2425 2426 7ff7bc09dd1f-7ff7bc09df3b call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc090510 * 3 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11d350 call 7ff7bc093680 * 5 call 7ff7bc093c10 2359->2426 2371->2034 2372->2371 2428 7ff7bc09e167-7ff7bc09e17f call 7ff7bc093c10 call 7ff7bc093680 2425->2428 2429 7ff7bc09df4b-7ff7bc09e166 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc090510 * 3 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11d350 call 7ff7bc093680 * 5 call 7ff7bc093c10 2425->2429 2426->2428 2428->2358 2429->2428
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Cpp_errorDecorator::getNameTableThrow_Typestd::_$Char_traitsCloseDefaultFileLanguageLocaleModuleOpenThrd_detachUserValuetype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: prnt=%ws&sys_lang=%ws$product$product$started$ui_closing_failed$ui_closing_timeout$ui_creation_error$ui_not_found$waiting_for_UI_connection$waiting_for_windows_creation$windows_created${"app" : {"show_window":"main"}}${"app": {"init": {"engineInit": true}}}
                                                                                                                                                                                                                            • API String ID: 2904651881-622979156
                                                                                                                                                                                                                            • Opcode ID: 537cf86ac9777247763bde07a778cdd90e7d19cfdb9f840ea4512ec6d71ec27b
                                                                                                                                                                                                                            • Instruction ID: e142a3c9fed7b3a624a9c26c15021a49a301b4ca3cdf0720bca4ba9ac8e0ce5f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 537cf86ac9777247763bde07a778cdd90e7d19cfdb9f840ea4512ec6d71ec27b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B4F2FA3260DAC291DA70AB18E8913EBA364FBD6740F809536D78D43BAEDF2CD554CB50
                                                                                                                                                                                                                            Function 00007FF7BC244210 Relevance: 28.5, APIs: 7, Strings: 9, Instructions: 477COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2613 7ff7bc244210-7ff7bc244236 2614 7ff7bc244238-7ff7bc244245 2613->2614 2615 7ff7bc244247-7ff7bc244267 call 7ff7bc128880 2613->2615 2614->2615 2616 7ff7bc24426c-7ff7bc244507 call 7ff7bc242c40 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc08d210 CreateEventW call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 2614->2616 2620 7ff7bc244e0b-7ff7bc244e12 2615->2620 2662 7ff7bc24450d-7ff7bc2446e3 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0902f0 call 7ff7bc23fff0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc240210 call 7ff7bc093680 * 3 2616->2662 2663 7ff7bc2446e4-7ff7bc244cf9 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0902f0 call 7ff7bc240030 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc240210 call 7ff7bc093680 * 2 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0902f0 call 7ff7bc240070 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc240210 call 7ff7bc093680 * 2 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0902f0 call 7ff7bc23ffb0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc240210 call 7ff7bc093680 * 2 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc0902f0 call 7ff7bc23ff70 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc240210 2616->2663 2662->2663 2755 7ff7bc244cfe-7ff7bc244e03 call 7ff7bc093680 * 2 call 7ff7bc0b12e0 call 7ff7bc0902f0 call 7ff7bc23feb0 call 7ff7bc1287a0 call 7ff7bc094730 call 7ff7bc093680 * 8 2663->2755 2755->2620
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateEventW.KERNEL32 ref: 00007FF7BC244324
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC2445E7
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC240210: CreateEventW.KERNEL32 ref: 00007FF7BC240238
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC24477F
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC24490F
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC244A9C
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC244C29
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC244D50
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC23FEB0: shared_ptr.LIBCMTD ref: 00007FF7BC23FF23
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::_SchedulerScheduler::_$shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$CreateEvent$Char_traitstype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: ClosingEvent$ColorPrevalence$ColorizationColor$EnableTransparency$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Themes\Personalize$Software\Microsoft\Windows\DWM$SystemUsesLightTheme$TaskbarAl
                                                                                                                                                                                                                            • API String ID: 2878102572-2470191940
                                                                                                                                                                                                                            • Opcode ID: 8e0d9e5715b9dbb02b6dd1a741e9d8e372e00079855f65546477bb3308d17288
                                                                                                                                                                                                                            • Instruction ID: 0a3048f452ebaee0c0dcf72412367c0f7608b796e77471096d9910512307232b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8e0d9e5715b9dbb02b6dd1a741e9d8e372e00079855f65546477bb3308d17288
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1452C236609BC595DAB1AB08E8903DBB3A8FBD9780F804126DB8C43B6DDF68D554CB50
                                                                                                                                                                                                                            Function 00007FF7BC13C300 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 111memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Decorator::getTableType$QueryValue$Globalwsprintf$AllocFree
                                                                                                                                                                                                                            • String ID: \StringFileInfo\%04x%04x\FileDescription$\StringFileInfo\%04x%04x\ProductVersion$\VarFileInfo\Translation
                                                                                                                                                                                                                            • API String ID: 3623593157-227869778
                                                                                                                                                                                                                            • Opcode ID: afe8b2dcc620858387f586322b9613184bd3ab54d5df8500ecc911c2893dbe4c
                                                                                                                                                                                                                            • Instruction ID: ecc47700843643bcbfee38a5f427e722c4e15460025253625daf50ccfb3727af
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: afe8b2dcc620858387f586322b9613184bd3ab54d5df8500ecc911c2893dbe4c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0C515F62618A4A81DB60EB19E4547BAF360FBD5784F809132EB8E837ADDF7CD544CB10
                                                                                                                                                                                                                            Function 00007FF7BC260140 Relevance: 23.4, APIs: 3, Strings: 10, Instructions: 662COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2817 7ff7bc260140-7ff7bc2603b3 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc25caf0 call 7ff7bc1188f0 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 call 7ff7bc091680 call 7ff7bc267830 2857 7ff7bc2603b8-7ff7bc2604a2 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc10bf80 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 2817->2857 2874 7ff7bc2604a8-7ff7bc26058f call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc267d20 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 2857->2874 2875 7ff7bc260590-7ff7bc260679 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc10bf80 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 2857->2875 2874->2875 2908 7ff7bc260767-7ff7bc2607b2 call 7ff7bc0a2900 call 7ff7bc0a2950 2875->2908 2909 7ff7bc26067f-7ff7bc260766 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc267d20 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 2875->2909 2921 7ff7bc2607b8-7ff7bc2608a8 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc10bf80 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 2908->2921 2922 7ff7bc260a73-7ff7bc260a82 call 7ff7bc0bf380 2908->2922 2909->2908 2980 7ff7bc260a6e 2921->2980 2981 7ff7bc2608ae-7ff7bc260a6d call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc267270 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 call 7ff7bc0bf420 call 7ff7bc0bb5c0 call 7ff7bc0bf420 call 7ff7bc25b360 call 7ff7bc25c430 2921->2981 2929 7ff7bc26109c-7ff7bc261112 call 7ff7bc25c450 call 7ff7bc25c430 call 7ff7bc0b9140 call 7ff7bc093be0 * 5 2922->2929 2930 7ff7bc260a88-7ff7bc26109b call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0bf420 call 7ff7bc0bb5c0 call 7ff7bc25b4e0 call 7ff7bc0f3390 call 7ff7bc0bf420 call 7ff7bc0bb5c0 call 7ff7bc25b760 call 7ff7bc0bb5c0 call 7ff7bc25b120 call 7ff7bc267e90 call 7ff7bc0905d0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc255480 call 7ff7bc0bc650 call 7ff7bc0a31e0 call 7ff7bc0904b0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc08d210 call 7ff7bc09a250 call 7ff7bc093680 * 2 call 7ff7bc093be0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11ca30 call 7ff7bc093680 * 4 call 7ff7bc0b91f0 call 7ff7bc093680 * 6 2922->2930 2930->2929 2980->2922 2981->2980
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090F30: char_traits.LIBCPMTD ref: 00007FF7BC090F5D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9B51
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9B8C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9BC8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC090EAD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D95B3
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D963C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1188F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC118930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1188F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF7BC118982
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1188F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC1189B2
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1188F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF7BC118A27
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC267830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC267944
                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF7BC260779
                                                                                                                                                                                                                            • HandleT.LIBCPMTD ref: 00007FF7BC260788
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Is_slash_oper::operatorstd::_$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_char_traitstype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: /p.gif$Default$Extensions$Guest Profile$Microsoft\Edge\User Data$Secure Preferences$data=%ws$ev.pcapp.store$ext_edge$pcdetails
                                                                                                                                                                                                                            • API String ID: 9541410-4110900778
                                                                                                                                                                                                                            • Opcode ID: 44cd162ec73c802bcb297e91d82f9f2557869d24587d6bb1536ea1997ec4711b
                                                                                                                                                                                                                            • Instruction ID: 067c7011d2bed5f3ad8b9ea606773ff1b2baef3d86a1e2c11f702f1d1cdb763c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 44cd162ec73c802bcb297e91d82f9f2557869d24587d6bb1536ea1997ec4711b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B982C572609AC695DAB0AB18E8903EFB364EBD6740F809132D78D43B6EDF2CD545CB50
                                                                                                                                                                                                                            Function 00007FF7BC25F160 Relevance: 23.4, APIs: 3, Strings: 10, Instructions: 661COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 3101 7ff7bc25f160-7ff7bc25f4c2 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090f30 call 7ff7bc0d9aa0 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc25caf0 call 7ff7bc1188f0 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 call 7ff7bc091680 call 7ff7bc267830 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc10bf80 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 3158 7ff7bc25f4c8-7ff7bc25f5af call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc267d20 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 3101->3158 3159 7ff7bc25f5b0-7ff7bc25f699 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc10bf80 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 3101->3159 3158->3159 3192 7ff7bc25f787-7ff7bc25f7d2 call 7ff7bc0a2900 call 7ff7bc0a2950 3159->3192 3193 7ff7bc25f69f-7ff7bc25f786 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc267d20 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 3159->3193 3205 7ff7bc25f7d8-7ff7bc25f8c8 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc10bf80 call 7ff7bc0b9140 * 2 call 7ff7bc093be0 3192->3205 3206 7ff7bc25fa93-7ff7bc25faa2 call 7ff7bc0bf380 3192->3206 3193->3192 3264 7ff7bc25fa8e 3205->3264 3265 7ff7bc25f8ce-7ff7bc25f983 call 7ff7bc090e90 call 7ff7bc0d9580 call 7ff7bc11f8f0 call 7ff7bc1188f0 call 7ff7bc267270 3205->3265 3213 7ff7bc2600bc-7ff7bc260132 call 7ff7bc25c450 call 7ff7bc25c430 call 7ff7bc0b9140 call 7ff7bc093be0 * 5 3206->3213 3214 7ff7bc25faa8-7ff7bc2600bb call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0bf420 call 7ff7bc0bb5c0 call 7ff7bc25b4e0 call 7ff7bc0f3390 call 7ff7bc0bf420 call 7ff7bc0bb5c0 call 7ff7bc25b760 call 7ff7bc0bb5c0 call 7ff7bc25b120 call 7ff7bc267e90 call 7ff7bc0905d0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc255480 call 7ff7bc0bc650 call 7ff7bc0a31e0 call 7ff7bc0904b0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc08d210 call 7ff7bc09a250 call 7ff7bc093680 * 2 call 7ff7bc093be0 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11ca30 call 7ff7bc093680 * 4 call 7ff7bc0b91f0 call 7ff7bc093680 * 6 3206->3214 3214->3213 3264->3206 3287 7ff7bc25f988-7ff7bc25fa8d call 7ff7bc0b9140 * 2 call 7ff7bc093be0 call 7ff7bc0bf420 call 7ff7bc0bb5c0 call 7ff7bc0bf420 call 7ff7bc25b360 call 7ff7bc25c430 3265->3287 3287->3264
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090F30: char_traits.LIBCPMTD ref: 00007FF7BC090F5D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9B51
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9B8C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9BC8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC090EAD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D95B3
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D963C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1188F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC118930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1188F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF7BC118982
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1188F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC1189B2
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1188F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF7BC118A27
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC267830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC267944
                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF7BC25F799
                                                                                                                                                                                                                            • HandleT.LIBCPMTD ref: 00007FF7BC25F7A8
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Is_slash_oper::operatorstd::_$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_char_traitstype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: /p.gif$Default$Extensions$Google\Chrome\User Data$Guest Profile$Secure Preferences$data=%ws$ev.pcapp.store$ext_chrome$pcdetails
                                                                                                                                                                                                                            • API String ID: 9541410-2486191938
                                                                                                                                                                                                                            • Opcode ID: 3f9ce52edb87be79f702af17bc757a2a6171e265e3eeae4a37095a496b74bf66
                                                                                                                                                                                                                            • Instruction ID: 638ce1e94bd4741e747e7a614655de1af9bdffe654cd1484dd7e0ffda2c60435
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3f9ce52edb87be79f702af17bc757a2a6171e265e3eeae4a37095a496b74bf66
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1882C572609AC695DAB0AB18E8903EFB364EBD6740F809132D78D43B6EDF2CD545CB50
                                                                                                                                                                                                                            Function 00007FF7BC0DBE70 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 264timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 3385 7ff7bc0dbe70-7ff7bc0dbeab 3386 7ff7bc0dbf50-7ff7bc0dbf52 3385->3386 3387 7ff7bc0dbeb1-7ff7bc0dbeca call 7ff7bc0c6b60 3385->3387 3388 7ff7bc0dc4c9-7ff7bc0dc4d0 3386->3388 3391 7ff7bc0dbee1-7ff7bc0dbeed 3387->3391 3392 7ff7bc0dbecc-7ff7bc0dbedf 3387->3392 3393 7ff7bc0dbef2-7ff7bc0dbf5d call 7ff7bc08d210 WinHttpConnect 3391->3393 3392->3393 3397 7ff7bc0dbf63-7ff7bc0dc2bb call 7ff7bc0905d0 GetTickCount64 call 7ff7bc0c6b60 3393->3397 3398 7ff7bc0dc449-7ff7bc0dc44b 3393->3398 3403 7ff7bc0dc2dd-7ff7bc0dc2f1 call 7ff7bc08d210 3397->3403 3404 7ff7bc0dc2bd-7ff7bc0dc2db call 7ff7bc08d210 3397->3404 3398->3388 3409 7ff7bc0dc2f9-7ff7bc0dc3cf call 7ff7bc08d210 call 7ff7bc09a250 call 7ff7bc08d210 WinHttpOpenRequest 3403->3409 3404->3409 3416 7ff7bc0dc3d1-7ff7bc0dc3f7 WinHttpSetTimeouts 3409->3416 3417 7ff7bc0dc43c-7ff7bc0dc453 call 7ff7bc093680 3409->3417 3416->3417 3418 7ff7bc0dc3f9-7ff7bc0dc3ff 3416->3418 3426 7ff7bc0dc485-7ff7bc0dc48a 3417->3426 3427 7ff7bc0dc455-7ff7bc0dc481 WinHttpSendRequest 3417->3427 3421 7ff7bc0dc401-7ff7bc0dc40c WinHttpCloseHandle 3418->3421 3422 7ff7bc0dc40d-7ff7bc0dc413 3418->3422 3421->3422 3424 7ff7bc0dc415-7ff7bc0dc420 WinHttpCloseHandle 3422->3424 3425 7ff7bc0dc421-7ff7bc0dc437 call 7ff7bc093680 3422->3425 3424->3425 3425->3388 3429 7ff7bc0dc48c-7ff7bc0dc499 WinHttpReceiveResponse 3426->3429 3430 7ff7bc0dc49d-7ff7bc0dc4a3 3426->3430 3427->3426 3429->3430 3432 7ff7bc0dc4a5-7ff7bc0dc4b0 WinHttpCloseHandle 3430->3432 3433 7ff7bc0dc4b1-7ff7bc0dc4b7 3430->3433 3432->3433 3434 7ff7bc0dc4c5 3433->3434 3435 7ff7bc0dc4b9-7ff7bc0dc4c4 WinHttpCloseHandle 3433->3435 3434->3388 3435->3434
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Http$CloseHandle$Requeststd::ios_base::good$ConnectCount64OpenReceiveResponseSendTickTimeouts
                                                                                                                                                                                                                            • String ID: GET
                                                                                                                                                                                                                            • API String ID: 2571818228-1805413626
                                                                                                                                                                                                                            • Opcode ID: 97b424a5f142e7ff86e6a48141ea42eb383f2602b031ef10f70d93426b751497
                                                                                                                                                                                                                            • Instruction ID: 3b1a0da288066520a8e87d9215a8aa80ae04d34b5169836eb523500c77eac19b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 97b424a5f142e7ff86e6a48141ea42eb383f2602b031ef10f70d93426b751497
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 76F16E36609FC585DAB09B1AF8843AAB3A4F799B94F504126DBCD43B68DF7CD094CB10
                                                                                                                                                                                                                            Function 00007FF7BC09E340 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 302windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 3436 7ff7bc09e340-7ff7bc09e36a 3437 7ff7bc09e395-7ff7bc09e39d 3436->3437 3438 7ff7bc09e36c-7ff7bc09e371 3436->3438 3441 7ff7bc09e3a3-7ff7bc09e3ab 3437->3441 3442 7ff7bc09e425-7ff7bc09e42e 3437->3442 3439 7ff7bc09e420 3438->3439 3440 7ff7bc09e377-7ff7bc09e37c 3438->3440 3449 7ff7bc09e9ec-7ff7bc09ea0b DefWindowProcW 3439->3449 3445 7ff7bc09e3b6 3440->3445 3446 7ff7bc09e37e-7ff7bc09e383 3440->3446 3447 7ff7bc09e3b1 3441->3447 3448 7ff7bc09e99b-7ff7bc09e9a4 3441->3448 3443 7ff7bc09e434-7ff7bc09e6d8 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090510 * 2 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11d350 call 7ff7bc093680 * 8 3442->3443 3444 7ff7bc09e6dd-7ff7bc09e6e6 3442->3444 3450 7ff7bc09e999 3443->3450 3444->3450 3451 7ff7bc09e6ec-7ff7bc09e998 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc090510 * 2 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc090450 call 7ff7bc0d8e90 call 7ff7bc11d350 call 7ff7bc093680 * 8 3444->3451 3445->3449 3455 7ff7bc09e9ba-7ff7bc09e9c3 PostQuitMessage 3446->3455 3456 7ff7bc09e389-7ff7bc09e38e 3446->3456 3458 7ff7bc09e9c5-7ff7bc09e9ea DefWindowProcW 3447->3458 3453 7ff7bc09e9a6-7ff7bc09e9af 3448->3453 3454 7ff7bc09e9b8 3448->3454 3457 7ff7bc09ea11-7ff7bc09ea18 3449->3457 3450->3449 3451->3450 3453->3454 3461 7ff7bc09e9b1 3453->3461 3454->3449 3455->3449 3462 7ff7bc09e390 3456->3462 3463 7ff7bc09e3bb-7ff7bc09e3d1 3456->3463 3458->3457 3461->3454 3462->3458 3466 7ff7bc09e3ef-7ff7bc09e3f8 3463->3466 3467 7ff7bc09e3d3-7ff7bc09e3ed PostMessageW 3463->3467 3470 7ff7bc09e414-7ff7bc09e416 3466->3470 3471 7ff7bc09e3fa-7ff7bc09e413 PostMessageW 3466->3471 3467->3470 3470->3457 3471->3470
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessagePostProcWindow$Quit
                                                                                                                                                                                                                            • String ID: msg=resume_suspend$msg=suspend$product$product$system_event$system_event
                                                                                                                                                                                                                            • API String ID: 3552470998-2520652036
                                                                                                                                                                                                                            • Opcode ID: 27947475573f83966e282697e3c0dd6a6a3718365272a7e70e730e185c8f9924
                                                                                                                                                                                                                            • Instruction ID: 93c2213cd50fbffaac85800d27e5764406d1b4b6780cd0dbffd5d94ee8e69eec
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 27947475573f83966e282697e3c0dd6a6a3718365272a7e70e730e185c8f9924
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3F1D83250DAC691E671AB18E8803EAB364FBEA740F809536DB8D42B6DDF7CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC0997D0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 439COMMON
                                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 3793 7ff7bc0997d0-7ff7bc099ae5 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 call 7ff7bc0911a0 call 7ff7bc0d98a0 call 7ff7bc08d210 call 7ff7bc0911a0 call 7ff7bc093680 GetClassNameW 3844 7ff7bc099ae7-7ff7bc099b04 GetWindowTextW 3793->3844 3845 7ff7bc099b59-7ff7bc099bc2 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc2a9110 3793->3845 3844->3845 3846 7ff7bc099b06-7ff7bc099b54 call 7ff7bc093c10 * 5 3844->3846 3862 7ff7bc099bc4-7ff7bc099bcc 3845->3862 3863 7ff7bc099bce 3845->3863 3870 7ff7bc09a134-7ff7bc09a13c 3846->3870 3865 7ff7bc099bd6-7ff7bc099bf3 call 7ff7bc093680 3862->3865 3863->3865 3871 7ff7bc099bf9-7ff7bc099c6a EnumChildWindows * 3 call 7ff7bc093c10 3865->3871 3872 7ff7bc099cad-7ff7bc099cb6 3865->3872 3879 7ff7bc099c6f-7ff7bc099ca8 call 7ff7bc093c10 * 4 3871->3879 3873 7ff7bc099d43-7ff7bc099d4a 3872->3873 3874 7ff7bc099cbc-7ff7bc099d3d call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc2a9110 3872->3874 3876 7ff7bc099d50-7ff7bc099d60 call 7ff7bc2a9298 3873->3876 3877 7ff7bc099dd5-7ff7bc099ddd 3873->3877 3874->3873 3929 7ff7bc099ddf 3874->3929 3876->3877 3890 7ff7bc099d62-7ff7bc099dd3 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc2a9110 3876->3890 3882 7ff7bc099de7-7ff7bc099df9 3877->3882 3879->3870 3887 7ff7bc099dfb-7ff7bc099e0d call 7ff7bc093680 3882->3887 3888 7ff7bc099e0e-7ff7bc099e17 3882->3888 3887->3888 3891 7ff7bc099e19-7ff7bc099e2b call 7ff7bc093680 3888->3891 3892 7ff7bc099e2c-7ff7bc099e33 3888->3892 3890->3877 3890->3929 3891->3892 3899 7ff7bc099e35-7ff7bc099e92 call 7ff7bc093c10 * 5 3892->3899 3900 7ff7bc099e97-7ff7bc099ea0 3892->3900 3899->3870 3903 7ff7bc099f26 3900->3903 3904 7ff7bc099ea6-7ff7bc099f1a call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc2a9110 3900->3904 3914 7ff7bc099f2e-7ff7bc099f40 3903->3914 3904->3903 3968 7ff7bc099f1c-7ff7bc099f24 3904->3968 3920 7ff7bc099f42-7ff7bc099f54 call 7ff7bc093680 3914->3920 3921 7ff7bc099f55-7ff7bc099f5c 3914->3921 3920->3921 3923 7ff7bc099fc0-7ff7bc099fc9 3921->3923 3924 7ff7bc099f5e-7ff7bc099fbb call 7ff7bc093c10 * 5 3921->3924 3935 7ff7bc09a04f 3923->3935 3936 7ff7bc099fcf-7ff7bc09a043 call 7ff7bc0910b0 call 7ff7bc0d9220 call 7ff7bc08d210 call 7ff7bc2a9110 3923->3936 3924->3870 3929->3882 3941 7ff7bc09a057-7ff7bc09a069 3935->3941 3936->3935 3984 7ff7bc09a045-7ff7bc09a04d 3936->3984 3947 7ff7bc09a06b-7ff7bc09a07d call 7ff7bc093680 3941->3947 3948 7ff7bc09a07e-7ff7bc09a085 3941->3948 3947->3948 3954 7ff7bc09a0e6-7ff7bc09a130 call 7ff7bc093c10 * 5 3948->3954 3955 7ff7bc09a087-7ff7bc09a0e4 call 7ff7bc093c10 * 5 3948->3955 3954->3870 3955->3870 3968->3914 3984->3941
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ChildEnumWindows$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsClassNameTextWindowshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: =====> %ws FOUND <=====$Shell_TrayWnd$Start$TrayButton$TrayDummySearchControl
                                                                                                                                                                                                                            • API String ID: 1535316472-2840285642
                                                                                                                                                                                                                            • Opcode ID: 48e2e4746e0d811653e34c36aaedc369d825ea0a07cb755e5234aef04255dc05
                                                                                                                                                                                                                            • Instruction ID: 2d33074681b47b006f311a09087635230ab354d12b05f2144680bd530436edae
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 48e2e4746e0d811653e34c36aaedc369d825ea0a07cb755e5234aef04255dc05
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC32FD3260DAC295E670AB59E8513EAF360FBE6740F808135D78D82AAEDF6CD544CF50
                                                                                                                                                                                                                            Function 00007FF7BC0AA0D0 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 273COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0A62C0: RegOpenKeyExW.ADVAPI32 ref: 00007FF7BC0A643E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0A62C0: RegQueryValueExW.ADVAPI32 ref: 00007FF7BC0A64F7
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC0AA211
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC0AA290
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC0AA41F
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC0AA31A
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Decorator::getTableType$shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsOpenQueryValuetype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: RESTART$RUNNING$Unknown+state=%d$close_state=%ws$invalid_app_close$product
                                                                                                                                                                                                                            • API String ID: 3445494136-3736349495
                                                                                                                                                                                                                            • Opcode ID: 1aff8bba0b8b590d5ea2f3cefc5725af3d78cf8a422b5d79fa6caf9edfad25c2
                                                                                                                                                                                                                            • Instruction ID: 5be8dddc7fb5ac8f2580f0f46d57a77de1f52c5174737108f6b222c2271bba4a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1aff8bba0b8b590d5ea2f3cefc5725af3d78cf8a422b5d79fa6caf9edfad25c2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 86E1D63260DAC295DA70AB18E8903EAB364FBDA740F809536E78D42B6DDF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC14B680 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 270comCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0AB220: _Subatomic.LIBCONCRTD ref: 00007FF7BC0AB28E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • CoInitialize.OLE32 ref: 00007FF7BC14BBAC
                                                                                                                                                                                                                            • CoCreateInstance.OLE32 ref: 00007FF7BC14BBDD
                                                                                                                                                                                                                            • shared_ptr.LIBCMTD ref: 00007FF7BC14BC13
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC14E0E0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF7BC14E15B
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC14E0E0: HandleT.LIBCPMTD ref: 00007FF7BC14E16A
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_CreateCriticalHandleInitializeInstanceLock::_ReentrantScoped_lockScoped_lock::~_Subatomictype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: SearchApp.exe$SearchHost.exe$SearchUI.exe$ShellExperienceHost.exe$StartMenuExperienceHost.exe$explorer.exe
                                                                                                                                                                                                                            • API String ID: 1408288539-3335880049
                                                                                                                                                                                                                            • Opcode ID: f04db94593c8664e50c795b0dabfdb6a222f85dd742c48e2e4a1ba454c1cf3a2
                                                                                                                                                                                                                            • Instruction ID: 407c24f9e0b9999ebb329095d11abf2c193ca095f012b44922b29a90745a8954
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f04db94593c8664e50c795b0dabfdb6a222f85dd742c48e2e4a1ba454c1cf3a2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9DE1E676609AC591DA60EB19E8903EAB360FBD6780F808036DB8D47B6DEF6CD444CB50
                                                                                                                                                                                                                            Function 00007FF7BC23CD30 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 242comCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • CoCreateInstance.OLE32 ref: 00007FF7BC23D0B8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC239560: SetLastError.KERNEL32 ref: 00007FF7BC239570
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00007FF7BC23D0D2
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC23D1C1
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$ErrorLast$Char_traitsConcurrency::details::_CreateInstanceSchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: CoCreateInstance+CLSID_AppVisibility+IID_IAppVisibility$CoInitialize+Init+Failed${"app" : {"hide_window": "menu_search"}}${"app" : {"hide_window": "menu_store"}}${"app" : {"menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}${"app" : {"show_window": "menu_store","menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}
                                                                                                                                                                                                                            • API String ID: 2502378382-2706694235
                                                                                                                                                                                                                            • Opcode ID: 2d0dd1afc8e15b8d23d8c2f80aee25c331c2ca040976932fb013047d532ad83b
                                                                                                                                                                                                                            • Instruction ID: e16755e74ff54c404f92d537382ab95534e2a9bcdca61fb377ad0e3f2a190ba2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2d0dd1afc8e15b8d23d8c2f80aee25c331c2ca040976932fb013047d532ad83b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6D1D63261DAC295DA71AB18E8913EAB364FBD6740F808136D78D43B6EDF2CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC092C70 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 52COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
                                                                                                                                                                                                                            • String ID: bad locale name
                                                                                                                                                                                                                            • API String ID: 3904239083-1405518554
                                                                                                                                                                                                                            • Opcode ID: c8096dea473fa920a14d580e4e777e2a6771f5c3d34b2eb5396def71f0eaedc1
                                                                                                                                                                                                                            • Instruction ID: 66661ceadc42732567fad9567ff00a8beba1ee306666f12f8aa4afdd100728fa
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c8096dea473fa920a14d580e4e777e2a6771f5c3d34b2eb5396def71f0eaedc1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0E113D11B0EB4682DE00F72EE84566EE360EF97788FA08431EB8D1376ACF2CD4118718
                                                                                                                                                                                                                            Function 00007FF7BC267270 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 245COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC255DD0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC255DED
                                                                                                                                                                                                                            • Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF7BC2672E0
                                                                                                                                                                                                                            • std::runtime_error::runtime_error.LIBCPMTD ref: 00007FF7BC26737F
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC093480: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC093493
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3DF0
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3E31
                                                                                                                                                                                                                            • Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF7BC2673E5
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090F30: char_traits.LIBCPMTD ref: 00007FF7BC090F5D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9B51
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9B8C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9BC8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC090EAD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D95B3
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D963C
                                                                                                                                                                                                                            • allocator.LIBCPMTD ref: 00007FF7BC267667
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1188C0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC1188D8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC25C630: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF7BC25C655
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC267733
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::$EmptyQueue::StructuredWork$Schedulershared_ptr$ProcessorProxyRoot::Virtual$Affinity::operator!=Concurrency::details::_ExceptionFileHardwareHeaderRaiseScheduler::_allocatorchar_traitsstd::runtime_error::runtime_errortype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: Could not open file for reading$extensions$settings
                                                                                                                                                                                                                            • API String ID: 486076642-1363464879
                                                                                                                                                                                                                            • Opcode ID: 00e2d055437f22abb0edd0b0952a5034d33d005831140abd5e25f67f66142306
                                                                                                                                                                                                                            • Instruction ID: c878e46f7962ff4a6ca388db9eb0d67147d76dd049fd1455ff4d5ea71f949e85
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 00e2d055437f22abb0edd0b0952a5034d33d005831140abd5e25f67f66142306
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 25D1B43261DAC195DA70AB18E8913EBB364FBD6340F809132D7CD86B6EEF28D545CB50
                                                                                                                                                                                                                            Function 00007FF7BC0916D0 Relevance: 13.1, APIs: 4, Strings: 3, Instructions: 827COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC23E070: CoInitializeEx.OLE32 ref: 00007FF7BC23E0E0
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0B8980: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC0B899A
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC091540: _Ptr_base.LIBCMTD ref: 00007FF7BC09154E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • CreateEventW.KERNEL32 ref: 00007FF7BC091C48
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0997A0: GetDesktopWindow.USER32 ref: 00007FF7BC0997A9
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0997A0: EnumChildWindows.USER32 ref: 00007FF7BC0997BC
                                                                                                                                                                                                                            • CreateDirectoryW.KERNEL32 ref: 00007FF7BC091DEF
                                                                                                                                                                                                                            • CreateEventW.KERNEL32 ref: 00007FF7BC091EEC
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC12C0B0: OpenEventW.KERNEL32 ref: 00007FF7BC12C1D6
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC091F52
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A2BD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7BC2A2C00
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A2BD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7BC2A2C06
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::CreateEmptyEventQueue::StructuredWork$Concurrency::cancel_current_task$Char_traitsChildConcurrency::details::_Decorator::getDesktopDirectoryEnumInitializeOpenPtr_baseSchedulerScheduler::_TableTypeWindowWindowsshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: ClosingEvent$DEBUGSCREEN_EVENT$\download
                                                                                                                                                                                                                            • API String ID: 3598548489-3079862309
                                                                                                                                                                                                                            • Opcode ID: c82cec3d028e14560f23b64cb9348d6fc42784cc35a44a7e4ec93eb65cec5846
                                                                                                                                                                                                                            • Instruction ID: d2dc9efe43219264b35eab72dc4a5c7f38089348617dfef2eb95e551e7af80c1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c82cec3d028e14560f23b64cb9348d6fc42784cc35a44a7e4ec93eb65cec5846
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A4A2F632609FC581DA70AB19E8943EBA3A4FBD5B81F409535DB8D47B9AEF7CC0448B10
                                                                                                                                                                                                                            Function 00007FF7BC106000 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 178COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112420: RegCreateKeyW.ADVAPI32 ref: 00007FF7BC112470
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112420: strrchr.LIBCMTD ref: 00007FF7BC112487
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112420: RegQueryValueExW.ADVAPI32 ref: 00007FF7BC1124D3
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112420: RegCloseKey.ADVAPI32 ref: 00007FF7BC1124ED
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC10620E
                                                                                                                                                                                                                            • std::ios_base::good.LIBCPMTD ref: 00007FF7BC10622A
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCreateKeyW.ADVAPI32 ref: 00007FF7BC112347
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegQueryValueExW.ADVAPI32 ref: 00007FF7BC112392
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCloseKey.ADVAPI32 ref: 00007FF7BC1123A1
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$CloseCreateQueryValue$Char_traitsDecorator::getTableTypestd::ios_base::goodstrrchrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: %lu$BuildNumber$CurrentBuild$SOFTWARE\Microsoft\Windows NT\CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
                                                                                                                                                                                                                            • API String ID: 1851878312-1501554625
                                                                                                                                                                                                                            • Opcode ID: 7c2db486576ae022e0b2eae786d1466e9bbb476585741725e17b8e70c29297e7
                                                                                                                                                                                                                            • Instruction ID: 8a4ceaeecb5e1584918a8b847ab3f8249114cefd9ca4951be374e507d30f4027
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7c2db486576ae022e0b2eae786d1466e9bbb476585741725e17b8e70c29297e7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 53A1E53251DAC290D670AB19E8803EAB364FBDA750F808136EBCD42B6DDF6CC554CB50
                                                                                                                                                                                                                            Function 00007FF7BC0AD500 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32 ref: 00007FF7BC0AD606
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • RegOpenKeyExW.ADVAPI32 ref: 00007FF7BC0AD681
                                                                                                                                                                                                                            • RegSetValueExW.ADVAPI32 ref: 00007FF7BC0AD6DA
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32 ref: 00007FF7BC0AD6FE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseFileModuleNameOpenValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: PCAppStore$Software\PCAppStore$status
                                                                                                                                                                                                                            • API String ID: 2919119571-3586994989
                                                                                                                                                                                                                            • Opcode ID: 56ce52650a82bc9e2fbebea71c554a030a70f3356052912a579f14b7df612c03
                                                                                                                                                                                                                            • Instruction ID: 1f837bff8d63722a852e54237fcf3df7a749e88765bc9efd952ccb85593486b8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56ce52650a82bc9e2fbebea71c554a030a70f3356052912a579f14b7df612c03
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7151E872619B8196D660EB18E8803AAB364FBD6780F809136E78D83B6DDF7CD544CB10
                                                                                                                                                                                                                            Function 00007FF7BC23E460 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 403COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF7BC23E6D8
                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF7BC23E7AE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::$Affinity::operator!=EmptyHardwareQueue::StructuredWork$Char_traitsshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: Shell_TrayWnd$Taskbar
                                                                                                                                                                                                                            • API String ID: 2730265358-1897506974
                                                                                                                                                                                                                            • Opcode ID: 1d6bf15bf8ba67a0132862503bd0e79296bf97a2fb17d9dd3cd196390ed812c5
                                                                                                                                                                                                                            • Instruction ID: a69da25ceea009d93674161741bf7e6ea0e2287e11872eb225534525477e7ed6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1d6bf15bf8ba67a0132862503bd0e79296bf97a2fb17d9dd3cd196390ed812c5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FE22E83261DA8595D660EB19E8912EEB3A0FBD6750F808132E7CD83BADDF2CD544CB10
                                                                                                                                                                                                                            Function 00007FF7BC2C5434 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 357ea1d0a50563d58e06b73b2e296228c9abeb08323b3827f84bef341498a252
                                                                                                                                                                                                                            • Instruction ID: 1587a7dad1afebd0829c4bbc7b1c7b4fd358cdf718f757a4e64bf8099974b259
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 357ea1d0a50563d58e06b73b2e296228c9abeb08323b3827f84bef341498a252
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DDC1C52290C78682E751BB1D94402FFA7A1EBA2BD0FD98131EB4D03399DF7DE8559720
                                                                                                                                                                                                                            Function 00007FF7BC112F10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$MetricsSystem
                                                                                                                                                                                                                            • String ID: 0
                                                                                                                                                                                                                            • API String ID: 2388057244-4108050209
                                                                                                                                                                                                                            • Opcode ID: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
                                                                                                                                                                                                                            • Instruction ID: a72c4b5f104de3966855ad155cef213c380a0c64bdf669d37a0b31b9a3b3b692
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AA014F766196468BE7249F24E05836AB7B1F789744F809139E78E42B8CDF7DC508CF10
                                                                                                                                                                                                                            Function 00007FF7BC13BBA0 Relevance: 9.2, APIs: 6, Instructions: 249COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 4cc3fc690caf46b215ce346ccdf43ddad07f5910bdaaf1cb7ebd7b0cc30fae4f
                                                                                                                                                                                                                            • Instruction ID: 8b66a6dce1dd88f6f6cc0626c09e49f4a97120261774b9d56f04132d3452b7cd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4cc3fc690caf46b215ce346ccdf43ddad07f5910bdaaf1cb7ebd7b0cc30fae4f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 59C1F87260DA8591DA60EB19E8403EAE7A0EBD6754F808136E78D93BA9DF7CD444CB10
                                                                                                                                                                                                                            Function 00007FF7BC0A62C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • RegOpenKeyExW.ADVAPI32 ref: 00007FF7BC0A643E
                                                                                                                                                                                                                            • RegQueryValueExW.ADVAPI32 ref: 00007FF7BC0A64F7
                                                                                                                                                                                                                            • RegCloseKey.ADVAPI32 ref: 00007FF7BC0A6523
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseOpenQueryValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: Software\PCAppStore$status
                                                                                                                                                                                                                            • API String ID: 2952970082-3794422696
                                                                                                                                                                                                                            • Opcode ID: b49c1bfec9ec0f1d07054d6a69a9bafb8fde114ca00e37293920e165ad04d86a
                                                                                                                                                                                                                            • Instruction ID: ff22b6357ee12373ad2bcf2ce7a4b72cd20719dad73dc3fd961f3e41a158dd9f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b49c1bfec9ec0f1d07054d6a69a9bafb8fde114ca00e37293920e165ad04d86a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9F61B33261DA8195DA60EB18E8903AAB3A4FBD5780F809136E78D43B6DDF7CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC14AB80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • OpenEventW.KERNEL32 ref: 00007FF7BC14AC42
                                                                                                                                                                                                                            • shared_ptr.LIBCMTD ref: 00007FF7BC14ACFD
                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF7BC14AD10
                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7BC14AD5E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::$EmptyQueue::StructuredWork$shared_ptr$Affinity::operator!=Char_traitsEventFac_nodeFac_node::_HardwareOpenstd::_type_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: DEBUGSCREEN_EVENT
                                                                                                                                                                                                                            • API String ID: 4219698036-491765807
                                                                                                                                                                                                                            • Opcode ID: d2d904154736474bd6cc130387a9755a96bf8d3bf1389759a611f73b0270fbab
                                                                                                                                                                                                                            • Instruction ID: 849e682d0e14821ee46b1cd47f7b0ebfb393f647a8462d194dda9134d72fce2d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d2d904154736474bd6cc130387a9755a96bf8d3bf1389759a611f73b0270fbab
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0751FA7261DA8691DA20AB19F8513EBA364FBD6780F808032E78D47B6EDF2CD505CB50
                                                                                                                                                                                                                            Function 00007FF7BC2AFC38 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2067211477-0
                                                                                                                                                                                                                            • Opcode ID: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
                                                                                                                                                                                                                            • Instruction ID: 990170e5331812a25edafe1790820ae294ae0562ee0500140d0f37e62b45f148
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 32214125A09B4295EE14FB6AA4501B9E361BFA6BE0F888531EF4D8375DDF3CE400C720
                                                                                                                                                                                                                            Function 00007FF7BC0ACDD0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 273COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0ACFDE
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCreateKeyW.ADVAPI32 ref: 00007FF7BC112347
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegQueryValueExW.ADVAPI32 ref: 00007FF7BC112392
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCloseKey.ADVAPI32 ref: 00007FF7BC1123A1
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • widgetInfo, xrefs: 00007FF7BC0AD19B
                                                                                                                                                                                                                            • {"app" : { "init" : {"guid":"%ws","cache_folder_path":"%ws", "engine_version":"%ws", "windows_version":"%ws", "locale_layout":"%ws, xrefs: 00007FF7BC0ACE1B
                                                                                                                                                                                                                            • {"app": {"widget":{"savedPosition": {"x": %d, "y": %d}}}}, xrefs: 00007FF7BC0AD30B
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Char_traitsCloseCreateQueryValuetype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: widgetInfo${"app" : { "init" : {"guid":"%ws","cache_folder_path":"%ws", "engine_version":"%ws", "windows_version":"%ws", "locale_layout":"%ws${"app": {"widget":{"savedPosition": {"x": %d, "y": %d}}}}
                                                                                                                                                                                                                            • API String ID: 2877627145-1185860185
                                                                                                                                                                                                                            • Opcode ID: 72364248b182cd46e3b606c788392e779dd2945632dddb0ad9b17ca2309ed22c
                                                                                                                                                                                                                            • Instruction ID: fb99d8607abd2a43c5f1848ee1f8cee55d9981905fcd66841e8e4dce21dfb56a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 72364248b182cd46e3b606c788392e779dd2945632dddb0ad9b17ca2309ed22c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 19F19F36609BC595DAB0AB19E8803DAB3A4FBD9780F808126DBCC43B6DDF78C554CB50
                                                                                                                                                                                                                            Function 00007FF7BC23F510 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 166COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: 2${"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
                                                                                                                                                                                                                            • API String ID: 3472098950-2542400605
                                                                                                                                                                                                                            • Opcode ID: 61a7fa5e66f4c6ca7671a1f1e866cfb882a4e161bbd59a599d7e207a0f2b2982
                                                                                                                                                                                                                            • Instruction ID: 1cf9110448eb9e14d2135196ee6e0cf153944d90b47d7b7a7c1f3160d304a491
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 61a7fa5e66f4c6ca7671a1f1e866cfb882a4e161bbd59a599d7e207a0f2b2982
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5391B576609BC59ADA70DB59F48439AB7A0F7D9B80F408126DB8D87B6ADF38D444CF00
                                                                                                                                                                                                                            Function 00007FF7BC252560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 130COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::_SchedulerScheduler::_
                                                                                                                                                                                                                            • String ID: 0u${"app": {"topbar": { "fullScreenMode": %d }}}${"app": {"topbar": { "rBinStatus": %d }}}
                                                                                                                                                                                                                            • API String ID: 2780765137-351494797
                                                                                                                                                                                                                            • Opcode ID: 3f82323b4b729b79f2adba7d0b023e24703731156eb6f7aab15cb6eb99691f22
                                                                                                                                                                                                                            • Instruction ID: f210f92867a235a691783e2a6889e331e4ba039bd9e590fc24b480f0b84f24c8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3f82323b4b729b79f2adba7d0b023e24703731156eb6f7aab15cb6eb99691f22
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4961E632619BC195DA60AB19E88039BB760FBD6780F808126EB8D43B6EDF3CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC240E70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorOpen
                                                                                                                                                                                                                            • String ID: registry was not opened
                                                                                                                                                                                                                            • API String ID: 151454242-1342567452
                                                                                                                                                                                                                            • Opcode ID: b0aaa059a0faca2b62a24eb3225f59ee551e50d45b26da248a41bca1b0e3c084
                                                                                                                                                                                                                            • Instruction ID: 5097f04ea47c9c7067452c3d725c9491003efbf96193f7a409989f27caa414fb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b0aaa059a0faca2b62a24eb3225f59ee551e50d45b26da248a41bca1b0e3c084
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0251E932619AC185DA60AB19E8913EAF3A0FBD6780F809035EB8D47B6DDF6CD554CB10
                                                                                                                                                                                                                            Function 00007FF7BC23F970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: System$Metrics$FromInfoMonitorParametersPoint
                                                                                                                                                                                                                            • String ID: (
                                                                                                                                                                                                                            • API String ID: 865970660-3887548279
                                                                                                                                                                                                                            • Opcode ID: 13e12977f7533f15ef69eddcbbfc0fd0c8348206ac9712c3fd55c20fe7d31477
                                                                                                                                                                                                                            • Instruction ID: 55721245d04d6cc5d29651e3c10cec13ff7007419b949447d6c0581a03742d5f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 13e12977f7533f15ef69eddcbbfc0fd0c8348206ac9712c3fd55c20fe7d31477
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F331503290C6868AD351AF2DF05026AFBA1EBD5B94F40C175E78D83B59CB3CD9418F20
                                                                                                                                                                                                                            Function 00007FF7BC09AFB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62synchronizationCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • OpenEventW.KERNEL32 ref: 00007FF7BC09B069
                                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32 ref: 00007FF7BC09B094
                                                                                                                                                                                                                            • CloseHandle.KERNEL32 ref: 00007FF7BC09B0B5
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseEventHandleObjectOpenSingleWaitshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: ClosingEvent
                                                                                                                                                                                                                            • API String ID: 4183184898-2998232585
                                                                                                                                                                                                                            • Opcode ID: 1cf474050192024b361a4a6dc055a2f162a69e904129f18a5aa2ca354e3e6860
                                                                                                                                                                                                                            • Instruction ID: d245992cee1718afe970dcbe627f5e871b3a357d4c1cbf1545daf04d4e180bf3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1cf474050192024b361a4a6dc055a2f162a69e904129f18a5aa2ca354e3e6860
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC312D3290CA4292EA50AB19E8813ABF7A1FBD6790F908135E78D42B7DDF7CD545CB10
                                                                                                                                                                                                                            Function 00007FF7BC0D98A0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D89D0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF7BC0D8B79
                                                                                                                                                                                                                            • shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D7D60: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC0D7D7A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::task_continuation_context::task_continuation_contextDecorator::getTableTypeshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4040233825-0
                                                                                                                                                                                                                            • Opcode ID: 42c90e878669586546bd47c4aac059a84cf45b7df95969407fa1727e5b9069fb
                                                                                                                                                                                                                            • Instruction ID: 7530e9d8cee17404dec08a7a9200ed7f4c8d44be2ef42e2dcafd5fafb6955588
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 42c90e878669586546bd47c4aac059a84cf45b7df95969407fa1727e5b9069fb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CF413E3251DA8691DA20EB19E8413EEF760FBD6780F809532E78D43AAEDF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC0DB0C0 Relevance: 6.1, APIs: 4, Instructions: 78synchronizationCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$ObjectSingleWait
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 282557418-0
                                                                                                                                                                                                                            • Opcode ID: e84f3ad846ed64f9196f56f3fe06c159fe096eb6db7144feb365fa05972e167c
                                                                                                                                                                                                                            • Instruction ID: 95fbef190c70e41f84d27779e3a0eab5ffd81b721d3764ea8b630a7e0f95839e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e84f3ad846ed64f9196f56f3fe06c159fe096eb6db7144feb365fa05972e167c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B0312261E0864682EE10A72DE84527EA390FF92B84FD04535EF8D477AEDF3CD5028B54
                                                                                                                                                                                                                            Function 00007FF7BC112420 Relevance: 6.1, APIs: 4, Instructions: 74registrystringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCreateQueryValuestrrchr
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2429320508-0
                                                                                                                                                                                                                            • Opcode ID: 34e9669a602a6d5b4418b13c00f7287a1401697c75688e90ed5ac91a49a29ab2
                                                                                                                                                                                                                            • Instruction ID: 05fc74ef8a2bd2f90fa95fe4e42c1d507a5723a431fd59d7189311cda2665faa
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34e9669a602a6d5b4418b13c00f7287a1401697c75688e90ed5ac91a49a29ab2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 25310A3261DA8682D650EB19E8802ABF364FBD6790F909535E78D83B6DDF7CD4048B50
                                                                                                                                                                                                                            Function 00007FF7BC12F480 Relevance: 6.1, APIs: 4, Instructions: 60comfileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateInitialize$FileIcmpInstanceSecurity
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 897544864-0
                                                                                                                                                                                                                            • Opcode ID: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
                                                                                                                                                                                                                            • Instruction ID: 644ac8bbb812fe8f2cd7a57fcf62a198026ace26c85dffbe22ecd3ae2303e328
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 14316576A08B8982EB00EF2EF45575EB361FB96B54F408139EA9D077A9CF3DD0058B44
                                                                                                                                                                                                                            Function 00007FF7BC112310 Relevance: 6.1, APIs: 4, Instructions: 58registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Close$CreateQueryValue
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2495337196-0
                                                                                                                                                                                                                            • Opcode ID: 560ce2b6002fda1f48c0e2119564795e5af3fb434074bb728d858a953253bbc0
                                                                                                                                                                                                                            • Instruction ID: 816698ee2522ec61e2657d3a12008077cf00cb32d0fbf421c283534ebbad22fb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 560ce2b6002fda1f48c0e2119564795e5af3fb434074bb728d858a953253bbc0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4621EE6252DA8281DA40EB1AF85026FB764FBD6780F509035F7CE47B69CF2CE4448F50
                                                                                                                                                                                                                            Function 00007FF7BC2422D0 Relevance: 6.0, APIs: 4, Instructions: 45registrywindowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ChangeCloseDecorator::getExceptionFileFormatHeaderMessageNotifyRaiseTableTypeValuestd::bad_exception::bad_exception
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 364703902-0
                                                                                                                                                                                                                            • Opcode ID: eb16407a55bedfc082493dc2b5cacc50af7eef1171e8d3171c4d170d14618321
                                                                                                                                                                                                                            • Instruction ID: 83f91f2635db26aa5c737881e03a1b41eebbc43acb6a2c25225a5a797e22d0bc
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb16407a55bedfc082493dc2b5cacc50af7eef1171e8d3171c4d170d14618321
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3212E36618A8186D720EB19E44439AF760F7D6788F908035E78C47BADDFBDD549CB10
                                                                                                                                                                                                                            Function 00007FF7BC081BB1 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7BC082059
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                                                            • String ID: $@
                                                                                                                                                                                                                            • API String ID: 3399187363-1077428164
                                                                                                                                                                                                                            • Opcode ID: 0b666c202780757cfef40bc775c35383df6c43439a90c621d7eb2c853760d3d1
                                                                                                                                                                                                                            • Instruction ID: d2211bda293ad1e188f177cad67263de172cb7915de5a5dc3d15b05d82d0c49b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b666c202780757cfef40bc775c35383df6c43439a90c621d7eb2c853760d3d1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 69D1A232249BC694DAB0AB09E8903DAB3A4F7D9340F809126DB8D43B6DEF79C554CB50
                                                                                                                                                                                                                            Function 00007FF7BC13B750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                            • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF7BC13B826
                                                                                                                                                                                                                            • HandleT.LIBCPMTD ref: 00007FF7BC13B835
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC13B6E0: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,00007FF7BC13B882), ref: 00007FF7BC13B709
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_CriticalHandleLock::_OpenProcessReentrantScoped_lockScoped_lock::~_type_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: NW_store.exe
                                                                                                                                                                                                                            • API String ID: 131083509-3827304589
                                                                                                                                                                                                                            • Opcode ID: 908a3785184dacab076b5fad28a87f3c6b692e18efd8f8c339602ab9e295a860
                                                                                                                                                                                                                            • Instruction ID: 721fc13581e7e976422da3cd9a6fcfa6885bb8f85a864a5aa9c7e6e0de19eb87
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 908a3785184dacab076b5fad28a87f3c6b692e18efd8f8c339602ab9e295a860
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8A41193260DA8595DA60AB19F4803AAF7A4FBD5784F808136E7CD43B6DDF2CD554CB10
                                                                                                                                                                                                                            Function 00007FF7BC0DAF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                            • WinHttpOpen.WINHTTP ref: 00007FF7BC0DB00E
                                                                                                                                                                                                                            • WinHttpSetTimeouts.WINHTTP ref: 00007FF7BC0DB080
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyHttpQueue::StructuredWork$Char_traitsOpenTimeoutstype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: WinHTTP 1.0
                                                                                                                                                                                                                            • API String ID: 2528808869-2851767304
                                                                                                                                                                                                                            • Opcode ID: 92c83c6423ad0cbd4c443393dd7077c058d7ccd3dd8c28dfbd58a898d25411b7
                                                                                                                                                                                                                            • Instruction ID: 9c18803cf6d1e2d564c715b87927ccebd2580df6c74be9780b2f22bd2bd5be08
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 92c83c6423ad0cbd4c443393dd7077c058d7ccd3dd8c28dfbd58a898d25411b7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 62310A32618A8282EA10EB19E8407ABB7A0FBD2740F809035EB8D47B6DDF7CD444CF50
                                                                                                                                                                                                                            Function 00007FF7BC0D8E90 Relevance: 4.7, APIs: 3, Instructions: 168COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Decorator::getTableType$shared_ptr$Char_traitsConcurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 43780872-0
                                                                                                                                                                                                                            • Opcode ID: e044b47141980675ed03ef6b9b78eb786f08d563665aa160f787ec86bfa55954
                                                                                                                                                                                                                            • Instruction ID: c0f7b9fd6fe43bc37ec97bc95939ee45cb8a619ea21bc5812b3401338e51fd12
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e044b47141980675ed03ef6b9b78eb786f08d563665aa160f787ec86bfa55954
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7381C93261DA8691DA70EB19E8513EAB360FBD6744F809532E78D43B6EDF2CD504CB50
                                                                                                                                                                                                                            Function 00007FF7BC284E5C Relevance: 4.6, APIs: 3, Instructions: 95COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Lockitstd::_$Concurrency::cancel_current_taskLockit::_Lockit::~_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2115809835-0
                                                                                                                                                                                                                            • Opcode ID: 76a9fce202ef56d2f48493d61718106d82de2c9d3e190339e50f4b1638c04129
                                                                                                                                                                                                                            • Instruction ID: 49cc8405f6f19005741821126be84d50d9e8a1d4c4f596cc5db3771f7d295956
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 76a9fce202ef56d2f48493d61718106d82de2c9d3e190339e50f4b1638c04129
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 49418D26609B4582EB15EB19E5942A9A360FFA9FC4F808432DF4E83B6DDF3CD851C350
                                                                                                                                                                                                                            Function 00007FF7BC1243D0 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC1243F2
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC105CE0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC105CF1
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC124475
                                                                                                                                                                                                                            • _Bitmask_includes.LIBCPMTD ref: 00007FF7BC1244DC
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Bitmask_includes
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2390111963-0
                                                                                                                                                                                                                            • Opcode ID: a83db4324a4abcfd552098a8bf7e40096f33cd78f084c4a2e058ad9279e2f5f2
                                                                                                                                                                                                                            • Instruction ID: f19d90d399a55e4fb9ae9094061fc7db19a086c5aa5ed641779c2dbb7cf9fdf5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a83db4324a4abcfd552098a8bf7e40096f33cd78f084c4a2e058ad9279e2f5f2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04412F61A0C58686E620EB19F4443AAF7A0FB96784F808135F7CD5BA9ECF2CD545CB50
                                                                                                                                                                                                                            Function 00007FF7BC267830 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC267944
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC090EAD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC25B680: _Idl_distance.LIBCPMTD ref: 00007FF7BC25B6CF
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090F30: char_traits.LIBCPMTD ref: 00007FF7BC090F5D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9B51
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9B8C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9BC8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D95B3
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D963C
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Idl_distancechar_traitstype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: profile
                                                                                                                                                                                                                            • API String ID: 4115068943-2170006031
                                                                                                                                                                                                                            • Opcode ID: d7019a625ae87c3d14717ea7dba6bc1d92d6f4bd2c28ab175a6f0aa4d511ef97
                                                                                                                                                                                                                            • Instruction ID: 5072d0532d6b7a4358e83a9b2c650a4578eca3cfb8cf1889c9c4cf1aa11208e7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d7019a625ae87c3d14717ea7dba6bc1d92d6f4bd2c28ab175a6f0aa4d511ef97
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3891C77250DAC691DA60AB19E8913EAB360FBD5780F809032E78D87BADDF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC0F9C90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52processCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateProcessstrrchr
                                                                                                                                                                                                                            • String ID: h
                                                                                                                                                                                                                            • API String ID: 4037516736-2439710439
                                                                                                                                                                                                                            • Opcode ID: 0b4d67693e087f15374fe2cb39532bd0f8a7dd7e7352cbe55a5af5981feb850d
                                                                                                                                                                                                                            • Instruction ID: b965015ed2656446f59c727b9311b0ba48b0951e7914b0c68bab50e723290e2b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b4d67693e087f15374fe2cb39532bd0f8a7dd7e7352cbe55a5af5981feb850d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7F21F932518A8282E710EB58E89039FF7A0F7E1354F908025E78D42AADDFBCD444CF50
                                                                                                                                                                                                                            Function 00007FF7BC2B6858 Relevance: 3.1, APIs: 2, Instructions: 132COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: e880bca60e20fa46b069a9fa51f681df6431c92be232c2e0220b988f896fe569
                                                                                                                                                                                                                            • Instruction ID: 9bbf610f4a9cf3fe550f534a224cf0ff08c29aa1988221e8584809078529c86c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e880bca60e20fa46b069a9fa51f681df6431c92be232c2e0220b988f896fe569
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D251F73290964147EA64EB1D94402BAB3A0EB67754F948231DB8D877D9CF3CE442D7B1
                                                                                                                                                                                                                            Function 00007FF7BC2B689C Relevance: 3.1, APIs: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 6a5b8f90e18411c57f8b0fba21bd4e9db6e17063562557f0c65fbbde9f2cf7de
                                                                                                                                                                                                                            • Instruction ID: 72099a2588cc27434ea3b929eac4e7db3e6b0e27b8ac114cc36f9d8be99c8dbd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6a5b8f90e18411c57f8b0fba21bd4e9db6e17063562557f0c65fbbde9f2cf7de
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3C31C232A18A4641EA58FB18D5511F9A361ABBAB90FD88135FB1D473DAEE3CE104C720
                                                                                                                                                                                                                            Function 00007FF7BC14E0E0 Relevance: 3.1, APIs: 2, Instructions: 76COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1248567937-0
                                                                                                                                                                                                                            • Opcode ID: 390d27b346eefd5e373e6541c632d24aac2aaa14e67103a187730549d5e0ef06
                                                                                                                                                                                                                            • Instruction ID: c41e3d507c4d4cae9e300bc6acf330deea4e172c844a4133f2243a2ef968c803
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 390d27b346eefd5e373e6541c632d24aac2aaa14e67103a187730549d5e0ef06
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 81312C6260CA8591DA20EB19F4402AEE760FBD6788F908431F7CD47B6EDF6CD5048B50
                                                                                                                                                                                                                            Function 00007FF7BC13C8F0 Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1248567937-0
                                                                                                                                                                                                                            • Opcode ID: ce55fdf648d57d359128e6b136c20f195132b49a2ee17734789cddced627295c
                                                                                                                                                                                                                            • Instruction ID: 5839242bacc622da258555e1a612bb99dd863a5ceaffc55d21955e67476c37f3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce55fdf648d57d359128e6b136c20f195132b49a2ee17734789cddced627295c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D5219F6251CA8591DA20E719F45026FFBA0EBDA788F944131F7CE46BAEDF2CC1108B20
                                                                                                                                                                                                                            Function 00007FF7BC2423C0 Relevance: 3.1, APIs: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: QueryValue
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3660427363-0
                                                                                                                                                                                                                            • Opcode ID: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
                                                                                                                                                                                                                            • Instruction ID: 094ed5416e35978b3623df818558e65da903d4cbe6d36784548355c55f2b6cb9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 19211976A29B8183DA909B19F48465AB3E4FB96790F905135FBCD07B28DF7CD444CB10
                                                                                                                                                                                                                            Function 00007FF7BC0DEBD0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallDecorator::getIndexatomicshared_ptr
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3391904811-0
                                                                                                                                                                                                                            • Opcode ID: 112a7a1cfea1af6a49f72f60085d69459d96c49a4b2313b8b527eccd42334bbb
                                                                                                                                                                                                                            • Instruction ID: 4c5693bf8606402ec36d1414a8684ea076c7fe4db769a1d8852f5936bec89f7f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 112a7a1cfea1af6a49f72f60085d69459d96c49a4b2313b8b527eccd42334bbb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8C11C636628A4586DB50EB19E48115EB7A4FBD5B84F909122FB8E43B69DF3CC544CB00
                                                                                                                                                                                                                            Function 00007FF7BC2A2BD0 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1173176844-0
                                                                                                                                                                                                                            • Opcode ID: 79828b8057ac0c13fd60be7f73fd30bcbbf421bb2b822df6622cab7814d851e4
                                                                                                                                                                                                                            • Instruction ID: e54b7295127c92ca1a9d324d864609ede646681c37514f743a3de19668da348b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 79828b8057ac0c13fd60be7f73fd30bcbbf421bb2b822df6622cab7814d851e4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 30E0B640E0E20746F95D756E18562F483404F2B372EACDB30FB3D443CAAD1CA4968130
                                                                                                                                                                                                                            Function 00007FF7BC1317A0 Relevance: 3.0, APIs: 2, Instructions: 16COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$ShowUpdate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2310006639-0
                                                                                                                                                                                                                            • Opcode ID: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
                                                                                                                                                                                                                            • Instruction ID: cc5d827716ae52d76206f7de955e24e4ec510aee06ee2a9c110ef28b8227c27b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 31E09A7AA25A8682DB40EB1AE895269A7A0F7D4B81F95D021EA4D43768DF38C4458B10
                                                                                                                                                                                                                            Function 00007FF7BC0997A0 Relevance: 3.0, APIs: 2, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ChildDesktopEnumWindowWindows
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2514311848-0
                                                                                                                                                                                                                            • Opcode ID: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
                                                                                                                                                                                                                            • Instruction ID: dae7e10fe38cde7815f2b4d33db6c0f95896bd615f89171d340038b822e5413f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8C0C969E16607C1DA04BB69B8991A4A360AF6A742FD0D030C60D116188E2C9159CF10
                                                                                                                                                                                                                            Function 00007FF7BC14CB80 Relevance: 3.0, APIs: 2, Instructions: 10COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ChildDesktopEnumWindowWindows
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2514311848-0
                                                                                                                                                                                                                            • Opcode ID: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
                                                                                                                                                                                                                            • Instruction ID: 2a29cc5dda07be82280c433af0e5028fdaf8b8735ab814b4c7c208edd39a0bd4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B4C01279E16707C1DA04BF69F8991A46360BF6B742FD0D030C64D157189E2C905D8F10
                                                                                                                                                                                                                            Function 00007FF7BC121C90 Relevance: 1.6, APIs: 1, Instructions: 124COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: std::ios_base::goodstd::ios_base::width
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3809604888-0
                                                                                                                                                                                                                            • Opcode ID: 2a2846e93e5db7df07bb6832996b9040466f5d44ec8004fb6c09cb166d862753
                                                                                                                                                                                                                            • Instruction ID: 0636083cbdce4e0f73b20d23f31186cf9a8fc4ca03d135a23a34e3a661060f1c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a2846e93e5db7df07bb6832996b9040466f5d44ec8004fb6c09cb166d862753
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9510D66A0C689CAD720EB19F44136BB7A0EB96784F908135E78E87B59DF3CD9008F50
                                                                                                                                                                                                                            Function 00007FF7BC0FC490 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetWindowTextW.USER32 ref: 00007FF7BC0FC4C6
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredTextWindowWork
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2447981796-0
                                                                                                                                                                                                                            • Opcode ID: b9d9d1665d410959826985c3fd1ff9749f565e3fb23e1f5d9c3ca40d19348786
                                                                                                                                                                                                                            • Instruction ID: a3dffd133f9c350caf1b14e8c51f638f5a8cddfac3e04cf2ff131d7aed319922
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b9d9d1665d410959826985c3fd1ff9749f565e3fb23e1f5d9c3ca40d19348786
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4411A3251CA8286D630AB19E8813ABF7A4FBD5744F808235E7CC86AADDF6CD544CF10
                                                                                                                                                                                                                            Function 00007FF7BC0EA3F0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __crt_scoped_stack_ptr
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1704660383-0
                                                                                                                                                                                                                            • Opcode ID: 2b64867363028eff0c91442592d46d6c6cb3060f987761c6e3f93457ab4b6b66
                                                                                                                                                                                                                            • Instruction ID: d95b5b0d162a0adec641d12183800885cf9ca6806e1f5cf81f9cccdc1fc63d79
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2b64867363028eff0c91442592d46d6c6cb3060f987761c6e3f93457ab4b6b66
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F41FC6260DB8581DA60EB19E8903AFB7A4FBD5784F404126EBCD47B6DDF2CD544CB10
                                                                                                                                                                                                                            Function 00007FF7BC2C5314 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 321343d00294838cecd101b12ef5f71ea6e8db055736ae24a32fa14de0d5b621
                                                                                                                                                                                                                            • Instruction ID: ad7b8b4fbed08fea278abdc7a371a254dc73aa64566e26c2b7664d31d9013543
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 321343d00294838cecd101b12ef5f71ea6e8db055736ae24a32fa14de0d5b621
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6031C421A1864686E7107B1E88423FEA750AF62BA0FC48135EB2C073DACFBDE4419731
                                                                                                                                                                                                                            Function 00007FF7BC240210 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • CreateEventW.KERNEL32 ref: 00007FF7BC240238
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC240D40: _Ptr_base.LIBCPMTD ref: 00007FF7BC240E31
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2422D0: RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FF7BC242308
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2422D0: FormatMessageW.KERNEL32 ref: 00007FF7BC242353
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2422D0: RegCloseKey.ADVAPI32 ref: 00007FF7BC24236C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2422D0: std::bad_exception::bad_exception.LIBCMTD ref: 00007FF7BC24238D
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ChangeCloseCreateEventFormatMessageNotifyPtr_baseValuestd::bad_exception::bad_exception
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1108121324-0
                                                                                                                                                                                                                            • Opcode ID: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
                                                                                                                                                                                                                            • Instruction ID: a27d60301fcba6beefd007b9ba0002bcb573d037ae8f84cf8b143569ec34acf1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E731E332619B8182DAA0EB19F88139EB7A0F7D5780F509126EBCD87B6DDF3CC0558B40
                                                                                                                                                                                                                            Function 00007FF7BC23E070 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Initialize
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2538663250-0
                                                                                                                                                                                                                            • Opcode ID: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
                                                                                                                                                                                                                            • Instruction ID: 6ef12ca769c77860e7c538f27e2eb49a075ec085775a07028ce2f1ca6ece87db
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0621F732A1CB4186EA10EB2DE88116AA3A1FBD6794F908535E7CD43B6DDF3CC0568F14
                                                                                                                                                                                                                            Function 00007FF7BC240D40 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Ptr_baseRef_count_baseRef_count_base::_std::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1305008675-0
                                                                                                                                                                                                                            • Opcode ID: 65c0800367382f8726241fb59fd89ea8d00f2246cafb299717e5cc92a3920bd3
                                                                                                                                                                                                                            • Instruction ID: 7d5de7653ba5e82daa43a71c273913f433edba41cedf9a9ae73ccf74f64e69ba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 65c0800367382f8726241fb59fd89ea8d00f2246cafb299717e5cc92a3920bd3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0331D432518B8582E650EB19F8403ABB7A0FBD6780F508526EBCE47B69DF3CD4548B90
                                                                                                                                                                                                                            Function 00007FF7BC2D0B14 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: e48b0f802f846f83354f8bcc0381103829573c63fa65d85b6fc9dff923b52bf1
                                                                                                                                                                                                                            • Instruction ID: b1cd1152bd9fec7107522e72e430a28c98f56d4ab51854dbf801022863dcf538
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e48b0f802f846f83354f8bcc0381103829573c63fa65d85b6fc9dff923b52bf1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6A21743360C68586DB65AF2CD4407A9B760EBA5B58FA88234E75D477EDDF3DD4008B10
                                                                                                                                                                                                                            Function 00007FF7BC2B0240 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: bbdd6f4acd2c37f0f0cea18607fb670f7e5b7d0a06c147e43de415a555d17051
                                                                                                                                                                                                                            • Instruction ID: 62509686a567fb5a078ab7770c83e43f8dc4719cbcb329868ccf680c3788391a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bbdd6f4acd2c37f0f0cea18607fb670f7e5b7d0a06c147e43de415a555d17051
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D111A46191C64141EA69BF5E94402FEE360BFAAB80F888431FB8D4778ACF3DD5008760
                                                                                                                                                                                                                            Function 00007FF7BC12B530 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                            • Opcode ID: a6f52692b4221cf8e344038bc2133ad2acadf011ad9ecd7645a69deb537d6bee
                                                                                                                                                                                                                            • Instruction ID: 5ef188d2dfd15e64170e2da2348132133f9b6f6d08a906e3f1050cef10de287b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a6f52692b4221cf8e344038bc2133ad2acadf011ad9ecd7645a69deb537d6bee
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 15211A32518B8582D640EB19E8912AEB7A0FBD6780F909035F78E47BA9DF3CC511CB50
                                                                                                                                                                                                                            Function 00007FF7BC08EC10 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                            • Opcode ID: b53e5842288276e939d4d8de75e71ee6bbf2d876da764cb478c09da6b84a371d
                                                                                                                                                                                                                            • Instruction ID: 9ee860e69cf7e0d0e1878b11406157c517e5448d5dd92bfc0adfcb8d82af4506
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b53e5842288276e939d4d8de75e71ee6bbf2d876da764cb478c09da6b84a371d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC212C32518B8182D640EB19E8553AEB7A0FBD6780F909136F78D83BA9DF3CC511CB50
                                                                                                                                                                                                                            Function 00007FF7BC26ED80 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                            • Opcode ID: ce57335518120c5bda6fde6f65474542a5aa26ce41ed83ae2f5198cd6978d16d
                                                                                                                                                                                                                            • Instruction ID: 7993404764bd9200bc6cb3e093e6878851b43a3205a7f01723e4313c9a54739e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ce57335518120c5bda6fde6f65474542a5aa26ce41ed83ae2f5198cd6978d16d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83114C32519B8582DA00FB15E8512AEB361FBD6B80F909436F78E837A9DF3CD510CB60
                                                                                                                                                                                                                            Function 00007FF7BC146310 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                            • Opcode ID: ad2e2740e0eb9326f266704e195f92b79a9eeec99dfb4f6a18dcc723286843f5
                                                                                                                                                                                                                            • Instruction ID: 4eb976a35d4ba50575ecf4359fa7b510a5328f3e586ea216e49f1d76f13a6c02
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad2e2740e0eb9326f266704e195f92b79a9eeec99dfb4f6a18dcc723286843f5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3F113A32519B8582DA00EB15E8553AEB361FBD6B44F808036F78E877AADF3CD500CB10
                                                                                                                                                                                                                            Function 00007FF7BC1463D0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 162856716-0
                                                                                                                                                                                                                            • Opcode ID: 31c809492498f58add146ec5b3123e21cd9b5a396ad75c3adf6fc977d4ff10c1
                                                                                                                                                                                                                            • Instruction ID: df50d0de6624533514fb2f12dea6b524bc85f04c1a6ac8e9eadc3a24761f2df2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 31c809492498f58add146ec5b3123e21cd9b5a396ad75c3adf6fc977d4ff10c1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 02110A72519B8582DA00EB15E8553AEB361FBD6B84F809136F78E877A9DF3CD504CB10
                                                                                                                                                                                                                            Function 00007FF7BC23FAE0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Ref_count_baseRef_count_base::_std::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1391782822-0
                                                                                                                                                                                                                            • Opcode ID: b0097962b4dfde2aa14eab4b58734fd89c11c4c6999dc842a1ef436c9f199952
                                                                                                                                                                                                                            • Instruction ID: ef66a278acd17a708aa90447e026d5e00ab8b6e769153e34effa8881db2db051
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b0097962b4dfde2aa14eab4b58734fd89c11c4c6999dc842a1ef436c9f199952
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3B11F832619B8982DA40EB1AF85016BB7A5FBD5B80F509436FBCD83B69CF3CD0508B40
                                                                                                                                                                                                                            Function 00007FF7BC2BF28C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 48bb363744d182ba232372bc05be0a51e6b3cba4a4dbe6b332463a11a3904b04
                                                                                                                                                                                                                            • Instruction ID: 8252d049e4babd0e06178cee1107be819e5b9f6d5f8ae6250a45f1e992c3b166
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 48bb363744d182ba232372bc05be0a51e6b3cba4a4dbe6b332463a11a3904b04
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 03111232A04B069CEB00EFA4D4812ED37B8FB19358F944626EB4D12B59EF34C295C3A0
                                                                                                                                                                                                                            Function 00007FF7BC25CAF0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FreeTask
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 734271698-0
                                                                                                                                                                                                                            • Opcode ID: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
                                                                                                                                                                                                                            • Instruction ID: f33ab3f2e2c46a7c1f17055c791a26804fa06a8b68c3df64b3a1548802bac870
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 05111972A28A4582E720EB19E44179BB360FBD9744F805121F78D86A6DDF3CE604CF10
                                                                                                                                                                                                                            Function 00007FF7BC08B050 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0A2260: stdext::threads::lock_error::lock_error.LIBCPMTD ref: 00007FF7BC0A2269
                                                                                                                                                                                                                            • _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7BC08B092
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo_noreturnstdext::threads::lock_error::lock_error
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 414106306-0
                                                                                                                                                                                                                            • Opcode ID: 7eaa5432c860693200022f1327d9c7e8a0ef9cad4840f8a3d96a02fa25242593
                                                                                                                                                                                                                            • Instruction ID: b86d9c8f3a339404e93867eadb3f2237da7a52d1cc4e261d5a42a40b9adf104e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7eaa5432c860693200022f1327d9c7e8a0ef9cad4840f8a3d96a02fa25242593
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6B015262619B4681D660AB2CEC4131FE390FB997A8F808230F7ED82BD9DF2CD5108B14
                                                                                                                                                                                                                            Function 00007FF7BC094B10 Relevance: 1.5, APIs: 1, Instructions: 35COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: LockitLockit::~_std::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4141856610-0
                                                                                                                                                                                                                            • Opcode ID: 4ed18daa84c5c558ccc116bd1d9ac16c48bdaac661717c99397de63d882cb418
                                                                                                                                                                                                                            • Instruction ID: 327cf9c7e88d4ed321b2ef2a24d50c7f50af76be0325c6b9c8b1a106e878f647
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4ed18daa84c5c558ccc116bd1d9ac16c48bdaac661717c99397de63d882cb418
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EBF0F661F2A74782DD44F75EA85656ED350AFD3B84B80A035FA4F1B75BCE2CD0114B18
                                                                                                                                                                                                                            Function 00007FF7BC094F80 Relevance: 1.5, APIs: 1, Instructions: 34stringCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWidestrrchr
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 276481755-0
                                                                                                                                                                                                                            • Opcode ID: 90ea61a3ccf4e1fcbaf4b10286a8553c1f97e2ef63e750d7ffc3b96bcd591249
                                                                                                                                                                                                                            • Instruction ID: e7d31b7fd70f78c79bff8c6d54f7cd1235c6e22dc7dc34135f2d2105dd519d41
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 90ea61a3ccf4e1fcbaf4b10286a8553c1f97e2ef63e750d7ffc3b96bcd591249
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D401A532A0C64287D620EB19E85036AB7A0F7DA748F604265E78D47AADCF7DD9408F50
                                                                                                                                                                                                                            Function 00007FF7BC255DD0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC255DED
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC105CE0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC105CF1
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1865873047-0
                                                                                                                                                                                                                            • Opcode ID: f53a0104ca1699a1dff8dd9072ce108e638b513950ee8d3201b6f48fb5c4f35b
                                                                                                                                                                                                                            • Instruction ID: 2537f1adbcb9fc97b5987a9c548c3ed7eece49a1101d34f9cfc60a0e2e5cc30a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f53a0104ca1699a1dff8dd9072ce108e638b513950ee8d3201b6f48fb5c4f35b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3014376608B8886CB10DF1AE49161EBB74F7DAB85FA08116EB8D43B28CF7DD511CB40
                                                                                                                                                                                                                            Function 00007FF7BC12FFE0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Name$NodeNode::
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2544435820-0
                                                                                                                                                                                                                            • Opcode ID: c5eb3d4471621ccbc52861cf316ed1686c60dd9bf9f3c63ff2dc3039ce938ba5
                                                                                                                                                                                                                            • Instruction ID: 8b89d5024c7de32d4aa0d0045ae93c18076eab022ab6ae1ccb7d0784b76b6211
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c5eb3d4471621ccbc52861cf316ed1686c60dd9bf9f3c63ff2dc3039ce938ba5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9201E972508A8596DA10EB19F48026EB3B4F7D6784FA08522EB8D53B69CF7DC501CB10
                                                                                                                                                                                                                            Function 00007FF7BC0FC410 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: atomic
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1039557753-0
                                                                                                                                                                                                                            • Opcode ID: 9ca185a43521d589ea1ec58c1bf6d9d8244aa92ec9fc2ff649280413e46ebf07
                                                                                                                                                                                                                            • Instruction ID: 6c54233c2549cae6bd9f2f4e4a1c48b5bab44015e539b4eab8253e9ad84aa540
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9ca185a43521d589ea1ec58c1bf6d9d8244aa92ec9fc2ff649280413e46ebf07
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: ABF02C26629E8582CA50EB25E48005FB375FBD9794B909222FB8E53B29DF28D5808B00
                                                                                                                                                                                                                            Function 00007FF7BC10D800 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FromMonitorPoint
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1566494148-0
                                                                                                                                                                                                                            • Opcode ID: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
                                                                                                                                                                                                                            • Instruction ID: 865207d96f55a41664b972a14d46301e7cfab5a6762a2b563d4530b806780339
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FFF04F32828E8586D212EF28E44025BF771FFDA784F509222F38E16A19DF3CD4858B00
                                                                                                                                                                                                                            Function 00007FF7BC105FA0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SHQueryRecycleBinW.SHELL32(?,?,?,?,?,?,?,?,?,?,00007FF7BC252639), ref: 00007FF7BC105FCC
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: QueryRecycle
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2469249176-0
                                                                                                                                                                                                                            • Opcode ID: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
                                                                                                                                                                                                                            • Instruction ID: e44fa77b16d095236a8fb4ec8ef2693ba12e6cd0565b2aefcff27ca3faff8e91
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 66F0126191CA8E92EA51AF18E44036AA361FFA3740FE09070E74E52988DF3CD5099B64
                                                                                                                                                                                                                            Function 00007FF7BC0C4E70 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • std::bad_exception::bad_exception.LIBCMTD ref: 00007FF7BC0C4E91
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0C52F0: std::locale::facet::facet.LIBCPMTD ref: 00007FF7BC0C5308
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC092C70: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7BC092C8F
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC092C70: _Yarn.LIBCPMTD ref: 00007FF7BC092CA1
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC092C70: _Yarn.LIBCPMTD ref: 00007FF7BC092CB3
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC092C70: _Yarn.LIBCPMTD ref: 00007FF7BC092CC5
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC092C70: _Yarn.LIBCPMTD ref: 00007FF7BC092CD7
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC092C70: _Yarn.LIBCPMTD ref: 00007FF7BC092CE9
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC092C70: _Yarn.LIBCPMTD ref: 00007FF7BC092CFB
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC092C70: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7BC092D13
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC094B10: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7BC094B92
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Yarn$std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_std::bad_exception::bad_exceptionstd::locale::facet::facet
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1679783481-0
                                                                                                                                                                                                                            • Opcode ID: efe89973728396c8319f64791479cc384f077f07f98f1bd6e23ce991356b9de8
                                                                                                                                                                                                                            • Instruction ID: fb6eb36473ad1a50a7694646bbc3482680bbebcc333b2600312b15a805279bde
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: efe89973728396c8319f64791479cc384f077f07f98f1bd6e23ce991356b9de8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 13F0F96260DA8691DA20EB18F8903AAA360FBD7344FC09531D6CD83B6ECF2CD508CB11
                                                                                                                                                                                                                            Function 00007FF7BC1067B0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: EnumWindows
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1129996299-0
                                                                                                                                                                                                                            • Opcode ID: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
                                                                                                                                                                                                                            • Instruction ID: 46f8322a71197d5bfb4410c3ae1f0b98ec31b2bebaf19bdc392262b131f12d6e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 86F05E7290854292DA20EF58E88109EF760F7D5398F804221E7CD42A6DDF7CD248CB10
                                                                                                                                                                                                                            Function 00007FF7BC096C30 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Func_classstd::bad_exception::bad_exception
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3621584023-0
                                                                                                                                                                                                                            • Opcode ID: 811ec457467a64cf29189dc53ead4d07727bd2a83de33478318602b153d018cd
                                                                                                                                                                                                                            • Instruction ID: c54dc290a6783bbee75bf5f573130b93d6112474cc976761bfa181e8f5173bef
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 811ec457467a64cf29189dc53ead4d07727bd2a83de33478318602b153d018cd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 96E01222A18B8585DA10BB29E84106EA360FBD6B80F908171FB8D8376ACF2CD4058A10
                                                                                                                                                                                                                            Function 00007FF7BC0F9BE0 Relevance: 1.5, APIs: 1, Instructions: 14comCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateInstance
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 542301482-0
                                                                                                                                                                                                                            • Opcode ID: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
                                                                                                                                                                                                                            • Instruction ID: 2f035c7bdd68282938e6c761e468a122268c770806a810d394e172259a732998
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 95E07576908B8586D610DF55F44004AB774F796794F904525EBCC02B28CF7CC165CF44
                                                                                                                                                                                                                            Function 00007FF7BC0C51F0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: std::bad_exception::bad_exception
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2160870905-0
                                                                                                                                                                                                                            • Opcode ID: 378930b60c09186e0c0f67021e624062e6a22285b3f326e3715c0ac8b94d4612
                                                                                                                                                                                                                            • Instruction ID: ca39dcd2092cdd94cd3b773b246e1ed3b27fce698d3f464461ba45e6c02ff861
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 378930b60c09186e0c0f67021e624062e6a22285b3f326e3715c0ac8b94d4612
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4CE0B666619A4482D620EB4AE88002BE3A1FBD9794F409121EB8D43B6DDF6CC1108B14
                                                                                                                                                                                                                            Function 00007FF7BC1243A0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • __std_fs_directory_iterator_open.LIBCPMT ref: 00007FF7BC1243C5
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2875F8: FindClose.KERNEL32(?,?,?,?,?,00007FF7BC1243CA), ref: 00007FF7BC287619
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2875F8: FindFirstFileExW.KERNEL32 ref: 00007FF7BC28763B
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst__std_fs_directory_iterator_open
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3791046848-0
                                                                                                                                                                                                                            • Opcode ID: 85fdb631bab1a170bc59e4487b9b1b9b43ae0330781ff348048b17804e7260d1
                                                                                                                                                                                                                            • Instruction ID: df0a49ea08487870c2e9667a1a99c8c462d38dc34c50c8990f95fff3c440959d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 85fdb631bab1a170bc59e4487b9b1b9b43ae0330781ff348048b17804e7260d1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 21D09EB6919B8081CA44EB16F88504AB764F7D97C0F505425FFCD43B29DF3CC1618B40
                                                                                                                                                                                                                            Function 00007FF7BC2875B8 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFindNext
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2029273394-0
                                                                                                                                                                                                                            • Opcode ID: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
                                                                                                                                                                                                                            • Instruction ID: 737e882d53c08188f85dbea4cb01be75a5c327876d79cb3504d8ddf3ce8d8ad4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6C04C18F1A543C1E655376A5C861A153906F66710FD48430C708D4358DD2C91E64635
                                                                                                                                                                                                                            Function 00007FF7BC08AF30 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: allocator
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3447690668-0
                                                                                                                                                                                                                            • Opcode ID: dec3b39dd94d1f2ea7fefd5dc669bf3bce3c72644ec74f011e531bc41841e9f6
                                                                                                                                                                                                                            • Instruction ID: 27405e0496ffce2bf08830f5acd2a2a69db2f12617ed039a1e9d2e3231508570
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dec3b39dd94d1f2ea7fefd5dc669bf3bce3c72644ec74f011e531bc41841e9f6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7CC0E966A29B8581CA44EB16F88101AB764F7D9BC1F909425FA8E43B29DF68C1558B10
                                                                                                                                                                                                                            Function 00007FF7BC2C0D5C Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • HeapAlloc.KERNEL32(?,?,00000000,00007FF7BC2C0BD6,?,?,?,00007FF7BC2A90F9,?,?,?,?,00007FF7BC2C0E08), ref: 00007FF7BC2C0DB1
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                                                                            • Opcode ID: 5ad3a28724de0d7eae44d08b4466c8c7512d1d24c667bf16be5eedaba0a8cd6e
                                                                                                                                                                                                                            • Instruction ID: 2b67481d4e93a9566e07e9c0eb43fb9c82d436b991c4465e0415d8b8f8cda6ed
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5ad3a28724de0d7eae44d08b4466c8c7512d1d24c667bf16be5eedaba0a8cd6e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0CF04908B0A70341FE587B6E54513F693949FAAB80FCC8034CB0E863DADE1CF4818230
                                                                                                                                                                                                                            Function 00007FF7BC2C0E10 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                                                                            • Opcode ID: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
                                                                                                                                                                                                                            • Instruction ID: 5f4d6a2d6da8d7c382339033e8b6236ab7a9bd6891bbf742571eb2a4cb6b88e1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: ACF0F405A4D64645F9687BA955412FAE3905F6AB60FC88634DF2E853CADE1CA4414530
                                                                                                                                                                                                                            Function 00007FF7BC09A4A0 Relevance: 1.3, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 626452242-0
                                                                                                                                                                                                                            • Opcode ID: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
                                                                                                                                                                                                                            • Instruction ID: 57382b22b49886eb40df8d035330a81b139c1346a706419816d51c5dd03b89b9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: ECD05B35A08A81C1D7207B69E41535BA7A1F7D5354F508224D7D9077E8DF7CC1458B44
                                                                                                                                                                                                                            Function 00007FF7BC097F00 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4292702814-0
                                                                                                                                                                                                                            • Opcode ID: 64d30b65498477a3495af4626b3c505657476d8f41d5f7a5527f686b3be6af0a
                                                                                                                                                                                                                            • Instruction ID: 77b561e57cac0604bb915e0c9d91407d84187343fd0d7c6c618562582660dfc5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 64d30b65498477a3495af4626b3c505657476d8f41d5f7a5527f686b3be6af0a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61D0C976A29F81C1C604EB16F88004AB7A0FBC9B84F80D425EB8E53738CF38C0A58B00
                                                                                                                                                                                                                            Function 00007FF7BC0F8C10 Relevance: 1.3, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Uninitialize
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3861434553-0
                                                                                                                                                                                                                            • Opcode ID: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
                                                                                                                                                                                                                            • Instruction ID: 4fddca000192b8c60e78233791c631f2279046517a60f34e774ed363dcf88e18
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2CB01229D19747C5C5043B79A88A0086320B7AB301FE0D030C248002148E2C40AE4B10

                                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                                            Function 00007FF7BC2876A8 Relevance: 27.2, APIs: 18, Instructions: 229fileCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2398595512-0
                                                                                                                                                                                                                            • Opcode ID: 355334dcceae02b49ab9097a0ac3bef8698e95b7cc128a7e9a7f23a438070136
                                                                                                                                                                                                                            • Instruction ID: 5acbc274b0cd75660dc892eb2d234666748a16c3ae47f544d01b3c3d655c711d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 355334dcceae02b49ab9097a0ac3bef8698e95b7cc128a7e9a7f23a438070136
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A916735E0860746E664AB2DA5086B5A390AF66BB4F948730EB7D877DCDF3CE401C720
                                                                                                                                                                                                                            Function 00007FF7BC28CD9C Relevance: 24.4, APIs: 16, Instructions: 377COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: LockitLockit::_std::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3382485803-0
                                                                                                                                                                                                                            • Opcode ID: bc1982defb8eac6dbef23eeeb8e29c9e44d69ad9987c82a9ef43d25c9a3d76a8
                                                                                                                                                                                                                            • Instruction ID: 61fe740e07fca37c0c01959592ff079a00a6802ff2bb359a3381805683e1b180
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc1982defb8eac6dbef23eeeb8e29c9e44d69ad9987c82a9ef43d25c9a3d76a8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 47D1D312A0964654FA15BB5DDA086F597119F627B4F888231EF1C87BDDDE3CE88BC320
                                                                                                                                                                                                                            Function 00007FF7BC2CE084 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C09FC: GetLastError.KERNEL32(?,?,00000001,00007FF7BC2AFE31,?,?,?,?,?,?,?,?,00007FF7BC2A8BFE,?,?,?), ref: 00007FF7BC2C0A0B
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C09FC: FlsGetValue.KERNEL32(?,?,00000001,00007FF7BC2AFE31,?,?,?,?,?,?,?,?,00007FF7BC2A8BFE,?,?,?), ref: 00007FF7BC2C0A20
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C09FC: SetLastError.KERNEL32(?,?,00000001,00007FF7BC2AFE31,?,?,?,?,?,?,?,?,00007FF7BC2A8BFE,?,?,?), ref: 00007FF7BC2C0AAB
                                                                                                                                                                                                                            • TranslateName.LIBCMT ref: 00007FF7BC2CE0EE
                                                                                                                                                                                                                            • TranslateName.LIBCMT ref: 00007FF7BC2CE129
                                                                                                                                                                                                                            • GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7BC2BEF5C), ref: 00007FF7BC2CE170
                                                                                                                                                                                                                            • IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF7BC2BEF5C), ref: 00007FF7BC2CE1A8
                                                                                                                                                                                                                            • GetLocaleInfoW.KERNEL32 ref: 00007FF7BC2CE365
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
                                                                                                                                                                                                                            • String ID: utf8
                                                                                                                                                                                                                            • API String ID: 3069159798-905460609
                                                                                                                                                                                                                            • Opcode ID: a5c22898e2945695cb41762edcb85fc8217139e9f061ba55afd410e2984fe297
                                                                                                                                                                                                                            • Instruction ID: 9606c6d3fa7e773dd78f86a90379fc5d194a35d5627c2d0ce03691d63e8e92f2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a5c22898e2945695cb41762edcb85fc8217139e9f061ba55afd410e2984fe297
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D0918032A0874285FB24BB29D4416FAA3A4EB66B80F84C131DF5C47799DF7CE961C361
                                                                                                                                                                                                                            Function 00007FF7BC2C7DDC Relevance: 9.3, APIs: 6, Instructions: 335timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7BC2C7E21
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C74E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BC2C74F8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C0DD4: HeapFree.KERNEL32(?,?,?,?,?,?,?,00007FF7BC09EBA3), ref: 00007FF7BC2C0DEA
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C0DD4: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF7BC09EBA3), ref: 00007FF7BC2C0DF4
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A8FD4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7BC2A8F83,?,?,?,?,?,00007FF7BC2A8E6E), ref: 00007FF7BC2A8FDD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A8FD4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7BC2A8F83,?,?,?,?,?,00007FF7BC2A8E6E), ref: 00007FF7BC2A9002
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7BC2C7E10
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C7544: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BC2C7558
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7BC2C8086
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7BC2C8097
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7BC2C80A8
                                                                                                                                                                                                                            • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7BC2C82E8), ref: 00007FF7BC2C80CF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4070488512-0
                                                                                                                                                                                                                            • Opcode ID: 2f425160c5abe6ccc173ace8d766040f4d324501a1043653b9a8bb0c3e747cfc
                                                                                                                                                                                                                            • Instruction ID: 1a15d9a82fbf697df78e00c8268acf6fc0f1b8e67c802a8fb6fa222690dc318f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2f425160c5abe6ccc173ace8d766040f4d324501a1043653b9a8bb0c3e747cfc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C8D19126E0864286E724BF2DD8905FAA761EB66B94FC4C035EB4D4779ADF3CE441C360
                                                                                                                                                                                                                            Function 00007FF7BC111E10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • std::bad_exception::bad_exception.LIBCMTD ref: 00007FF7BC111E3E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0F65A0: std::bad_exception::bad_exception.LIBCMTD ref: 00007FF7BC0F65B8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3DF0
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3E31
                                                                                                                                                                                                                            • GetProcessHeap.KERNEL32 ref: 00007FF7BC111E55
                                                                                                                                                                                                                            • HeapAlloc.KERNEL32 ref: 00007FF7BC111E64
                                                                                                                                                                                                                            • std::bad_alloc::bad_alloc.LIBCMTD ref: 00007FF7BC111E7B
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Heapstd::bad_exception::bad_exception$AllocExceptionFileHeaderProcessRaisestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                            • String ID: length
                                                                                                                                                                                                                            • API String ID: 760574106-25009842
                                                                                                                                                                                                                            • Opcode ID: 5c0fcbe49bfe53a51c9c6909a439c2f15d3f8fd499fdc297643477aa614b99e6
                                                                                                                                                                                                                            • Instruction ID: 7fc631ea9ba43f4a5c186c82e42afae9da9a00f0b8fa218f6a73e25ebb2f0377
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5c0fcbe49bfe53a51c9c6909a439c2f15d3f8fd499fdc297643477aa614b99e6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E213072A18A4682DA20EB1CE4401AEA7A0FB99744FD08135E78D477ADDF3CD145CB10
                                                                                                                                                                                                                            Function 00007FF7BC281254 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7BC2812D7
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CriticalInitializeSection$DebugDebuggerErrorLastOutputPresentString__vcrt_
                                                                                                                                                                                                                            • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                                                            • API String ID: 3055932891-631824599
                                                                                                                                                                                                                            • Opcode ID: 536e1cbde581abdcf4f6eeb0427798af8337269c14b6612caf455d91a3591f50
                                                                                                                                                                                                                            • Instruction ID: d77ba3817abd1c06039c140ef068761d8c5450ec2627a303a3e37d60ea92aafe
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 536e1cbde581abdcf4f6eeb0427798af8337269c14b6612caf455d91a3591f50
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 32118F32A14B5297F705AB2AD6453B973A0FF25744F808135C74D82A99EF3CE0B4C724
                                                                                                                                                                                                                            Function 00007FF7BC107BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0FA6B0: GetUserDefaultUILanguage.KERNEL32 ref: 00007FF7BC0FA6DE
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0FA6B0: LCIDToLocaleName.KERNEL32 ref: 00007FF7BC0FA6FD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                            • GetLocaleInfoEx.KERNEL32 ref: 00007FF7BC107CA4
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC107CF1
                                                                                                                                                                                                                            • GetLocaleInfoEx.KERNEL32 ref: 00007FF7BC107D24
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyLocaleQueue::StructuredWorkshared_ptr$Info$Char_traitsDefaultLanguageNameUsertype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: unknown
                                                                                                                                                                                                                            • API String ID: 378872536-2904991687
                                                                                                                                                                                                                            • Opcode ID: 987cb7059059bc9a99e34d1a4724fe3e7b56ed7ee8f81bfa02680fe9b3f7369b
                                                                                                                                                                                                                            • Instruction ID: ede4bfcf167949762eb734c4613eadf61e08a50dd186c1bc40602d7a56954b82
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 987cb7059059bc9a99e34d1a4724fe3e7b56ed7ee8f81bfa02680fe9b3f7369b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C041FC3261DA8191D660EB18E8917ABB7A0FBD6780F809136E78D43B6EDF2CD544CF50
                                                                                                                                                                                                                            Function 00007FF7BC2C8058 Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7BC2C8086
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C7544: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BC2C7558
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7BC2C8097
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C74E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BC2C74F8
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF7BC2C80A8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C7514: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7BC2C7528
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C0DD4: HeapFree.KERNEL32(?,?,?,?,?,?,?,00007FF7BC09EBA3), ref: 00007FF7BC2C0DEA
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2C0DD4: GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF7BC09EBA3), ref: 00007FF7BC2C0DF4
                                                                                                                                                                                                                            • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7BC2C82E8), ref: 00007FF7BC2C80CF
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3458911817-0
                                                                                                                                                                                                                            • Opcode ID: 80d45e89f01a5ba7eff126cc66145718d0509105700d4f5034b80e55f1383869
                                                                                                                                                                                                                            • Instruction ID: 5ae3cf51b52f141cc8c71950e1aa57e67bca954877159e7db485f6de087aa7a6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 80d45e89f01a5ba7eff126cc66145718d0509105700d4f5034b80e55f1383869
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 28513232A0864296E720FF2DD8915EAA760BB6A744FC0C139EB5D4779ADF3CE4408760
                                                                                                                                                                                                                            Function 00007FF7BC2C37E4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: InfoLocale
                                                                                                                                                                                                                            • String ID: GetLocaleInfoEx
                                                                                                                                                                                                                            • API String ID: 2299586839-2904428671
                                                                                                                                                                                                                            • Opcode ID: 7e7bf80ab72caf946d0937cb0ea7649744d3b84c6a2f66bad2f00b62b2aa4bac
                                                                                                                                                                                                                            • Instruction ID: 0a4d50cdf98bf04e3cc54828804f4bf2a9064c85d87eb990cfda911a58eb7759
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7e7bf80ab72caf946d0937cb0ea7649744d3b84c6a2f66bad2f00b62b2aa4bac
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 01017125B08A4285EA00AB5AB4405E6E760ABA6BC0F98C536DF4D13B5DCE3CD505C351
                                                                                                                                                                                                                            Function 00007FF7BC2C324C Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7BC2C36F3,?,?,?,?,?,?,?,?,00000000,00007FF7BC2CDA30), ref: 00007FF7BC2C329B
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: EnumLocalesSystem
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2099609381-0
                                                                                                                                                                                                                            • Opcode ID: 852e36dff65b922cbb187eeb959fedcf688cda41a3647a78d61078f0be31a5f6
                                                                                                                                                                                                                            • Instruction ID: 1f7ea34d68b68fd70cb6ed6a77f1a49754e3d31ca7db3b4a594c07230ed51f19
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 852e36dff65b922cbb187eeb959fedcf688cda41a3647a78d61078f0be31a5f6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A6F06D71B08B41C2E700EB19E8915A9B375EBAA7C0F948035EB4D83369CE3CD450C310
                                                                                                                                                                                                                            Function 00007FF7BC287B24 Relevance: .0, Instructions: 10COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 96deb49f9c9e0e377063350eb5d5da8a57a3189ba4225a268213569ed96476fb
                                                                                                                                                                                                                            • Instruction ID: 87b5fba4373d53bd7ec3bbe030137a52f3b83f8fcc1c73fde0c1f260f0c650a2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 96deb49f9c9e0e377063350eb5d5da8a57a3189ba4225a268213569ed96476fb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3EC01218F0BA43C1E9193B2AA8864689360AF3BB01FC4E075C30C15368CE2C61A28721
                                                                                                                                                                                                                            Function 00007FF7BC265A90 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 439COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7BC266279
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D7E60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D7EF7
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsFac_nodeFac_node::_shared_ptrstd::_type_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: ClassGuid$CompatID$Description$DevLoader$DeviceClass$DeviceID$DeviceName$DriverDate$DriverName$DriverProviderName$DriverVersion$FriendlyName$HardWareID$InfName$Location$Manufacturer$Name$PDO$Signer$StartMode$Status$SystemCreationClassName$SystemName
                                                                                                                                                                                                                            • API String ID: 2107158585-2483722238
                                                                                                                                                                                                                            • Opcode ID: eb293c1746a966074f26d9537311439fee5a1a86e8bb700df527b3a9aba83937
                                                                                                                                                                                                                            • Instruction ID: 69abbcab885583eba493ba8defe3eaf1a07c91690f12acf61cafcc6837bf64f2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eb293c1746a966074f26d9537311439fee5a1a86e8bb700df527b3a9aba83937
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DF32DF7261DAC2A1EA70AB18E8903EAB364FBD6744FC09436D78D43A6DDF6CD544CB10
                                                                                                                                                                                                                            Function 00007FF7BC0E6DF0 Relevance: 30.2, APIs: 16, Strings: 1, Instructions: 430COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Affinity::operator!=Concurrency::details::Hardwareshared_ptr$Lockitstd::_$GetfacetLockit::_Lockit::~_Mpunctstd::locale::_
                                                                                                                                                                                                                            • String ID: 0123456789ABCDEFabcdef-+Xx
                                                                                                                                                                                                                            • API String ID: 2889901185-2799312399
                                                                                                                                                                                                                            • Opcode ID: 432d304fe1b6997aa18e4637ad5b94b336e2412e3285c0f1698c26b15de39032
                                                                                                                                                                                                                            • Instruction ID: 372d133606a01e783ac798d2effac07f62445071d36b46552da831414c9dfe51
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 432d304fe1b6997aa18e4637ad5b94b336e2412e3285c0f1698c26b15de39032
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2A22542290C6D684E670AB1DE8503BFF7A4EBE6744F804136E7CD86A9DDF2CD5418B60
                                                                                                                                                                                                                            Function 00007FF7BC123500 Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 342COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090F30: char_traits.LIBCPMTD ref: 00007FF7BC090F5D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9B51
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9B8C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9AA0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9BC8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC090EAD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D95B3
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D9580: shared_ptr.LIBCMTD ref: 00007FF7BC0D963C
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC12373C
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC11F990: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC11F9B2
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC123916
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC123B17
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC123BAB
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC123BC1
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC123C03
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC122250: Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF7BC1222BA
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC123C3C
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC123C62
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::$EmptyQueue::StructuredWork$shared_ptr$ProcessorProxyRoot::SchedulerVirtualchar_traitstype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: \HRDR_places.sqlite$\Mozilla\Firefox\Profiles\$\places.sqlite$appdata$temp
                                                                                                                                                                                                                            • API String ID: 2671280029-1746454586
                                                                                                                                                                                                                            • Opcode ID: 927f53e1c73ee13d557880e8a333421c5f7636c4a294ee3b2db882f7c5630002
                                                                                                                                                                                                                            • Instruction ID: 62e3b524bb5c9794ea23a092b8ead6814932e22ca21f95748a53a205cba5a9ec
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 927f53e1c73ee13d557880e8a333421c5f7636c4a294ee3b2db882f7c5630002
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4A12C57650DAC691DA70AB19F8913EFB364EBD6780F808036D78D42B6EDF28D544CB50
                                                                                                                                                                                                                            Function 00007FF7BC0BD788 Relevance: 21.4, APIs: 5, Strings: 7, Instructions: 369COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0BD89B
                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF7BC0BD9B6
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0BDADA
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0BDC58
                                                                                                                                                                                                                            • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF7BC0BDDBB
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::$EmptyQueue::StructuredWork$Affinity::operator!=Hardware
                                                                                                                                                                                                                            • String ID: "bytes": [$"subtype": $],$],"subtype":$null$null}${"bytes":[
                                                                                                                                                                                                                            • API String ID: 2268291814-3853568864
                                                                                                                                                                                                                            • Opcode ID: 62cd5a440f190d55e1cd79f453e4afa18557a6c443adb3c6639d2d035e0afc39
                                                                                                                                                                                                                            • Instruction ID: b939a5e358d765b6b8c4cd5aa05a99427b9a0c35eee20aac5c181503a1802aa9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 62cd5a440f190d55e1cd79f453e4afa18557a6c443adb3c6639d2d035e0afc39
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4C12CA76609BC581DA70EB1AE4903AEB3A5F7D9B80F808026DB8D47B69DF2CD540CB54
                                                                                                                                                                                                                            Function 00007FF7BC0A3B30 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 306COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC0A3E21
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC0A3E9B
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC0A3F2D
                                                                                                                                                                                                                            • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC0A3FA7
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCreateKeyW.ADVAPI32 ref: 00007FF7BC112347
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegQueryValueExW.ADVAPI32 ref: 00007FF7BC112392
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112310: RegCloseKey.ADVAPI32 ref: 00007FF7BC1123A1
                                                                                                                                                                                                                            • SetEvent.KERNEL32 ref: 00007FF7BC0A4217
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Decorator::getTableType$Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsCloseCreateEventQueryValuetype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: RES_COUNT$exit$product$product$reason=%ws$reload${"app" : { "close_app" : 1}}
                                                                                                                                                                                                                            • API String ID: 1544965098-3700722040
                                                                                                                                                                                                                            • Opcode ID: 76c878cf79d10794fd21d74bdfbec2a78fc61c31d9300a4c530bdd901754a939
                                                                                                                                                                                                                            • Instruction ID: eadd06c3683b963fcf0f98f8a4d52205766d7cc9d306a01a1d54f783174759ca
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 76c878cf79d10794fd21d74bdfbec2a78fc61c31d9300a4c530bdd901754a939
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B02C63660DAC295DA70AB19E8803EAB364FBDA740F809136DBCD43B6DDF68D544CB50
                                                                                                                                                                                                                            Function 00007FF7BC0CDB80 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 182COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Decorator::getTableType$std::ios_base::good$Concurrency::task_continuation_context::task_continuation_context
                                                                                                                                                                                                                            • String ID: %5B$%5B$%5D$%5D
                                                                                                                                                                                                                            • API String ID: 1894544629-3613181305
                                                                                                                                                                                                                            • Opcode ID: 42933e79853cbeb047eccf4e8039041145a713ce86a9cbb0e2f27531e555f8da
                                                                                                                                                                                                                            • Instruction ID: c515ce59b5b717cf4299eede9faf05b4caa40108dfe56b1e524361720c057278
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 42933e79853cbeb047eccf4e8039041145a713ce86a9cbb0e2f27531e555f8da
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D691FC3251DAC690DA70AB19E8413EBA364FBEA340F809532D78D83B6EDF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC0ABD30 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 200COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32 ref: 00007FF7BC0ABDA5
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC10CF90: RegOpenKeyExW.ADVAPI32 ref: 00007FF7BC10D0F6
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC10CF90: RegQueryValueExW.ADVAPI32 ref: 00007FF7BC10D1BA
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0ABDC1
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                            • ShellExecuteW.SHELL32 ref: 00007FF7BC0ABE92
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00007FF7BC0ABEA0
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC090551
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Char_traitsDecorator::getErrorExecuteFileLastModuleNameOpenQueryShellTableTypeValuetype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: $/init %ws /restart$eCode=%lu$open$product$reload_error
                                                                                                                                                                                                                            • API String ID: 1419841695-2650242239
                                                                                                                                                                                                                            • Opcode ID: 8296f1e88d97ede649822802191ae60b2c87f97d9626b25322d283d911edaa59
                                                                                                                                                                                                                            • Instruction ID: 5514ca58f47a13eb246c0a221940f5b662d5bd3530cbff73f7ae3de26347905d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8296f1e88d97ede649822802191ae60b2c87f97d9626b25322d283d911edaa59
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 60B1C73260DAC2A1DA70AB18E8913EAB364FBDA340F809536D78D43B6DDF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC10B720 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 174COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090F30: char_traits.LIBCPMTD ref: 00007FF7BC090F5D
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC10B7D0
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC10B801
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC10B939
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC10BAAE
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0B1F30: char_traits.LIBCPMTD ref: 00007FF7BC0B1F50
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0B1F30: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0B1FA4
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC10BA06
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090E00: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC090E1D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: type_info::_name_internal_method$Concurrency::details::EmptyQueue::StructuredWorkchar_traits
                                                                                                                                                                                                                            • String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
                                                                                                                                                                                                                            • API String ID: 1744367693-4239264347
                                                                                                                                                                                                                            • Opcode ID: b2d4a3a5882bfcf986f1752a5fc00b982194c0c51f2aca48db01436fac4f58f5
                                                                                                                                                                                                                            • Instruction ID: 54e8ab8111f37de1e50f14f7928770a163176f2f96bb3540cf19117e00ada3ae
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2d4a3a5882bfcf986f1752a5fc00b982194c0c51f2aca48db01436fac4f58f5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0C91C77251DAC691DA70EB19E8913EAB364FBE6780F808132E78D42B6DDF2CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC2360C0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 190registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: List$ClassCursorLoadRegister
                                                                                                                                                                                                                            • String ID: StartReplace
                                                                                                                                                                                                                            • API String ID: 1846139413-3907892786
                                                                                                                                                                                                                            • Opcode ID: a50ead5bddd13cb991aa8bc3898b07f07b694fb31e11f773c9e228be75b4e0ab
                                                                                                                                                                                                                            • Instruction ID: 211d25345f0483696b8545e8ad60bd697462f000289bb50b15071861efbd5072
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a50ead5bddd13cb991aa8bc3898b07f07b694fb31e11f773c9e228be75b4e0ab
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 01A1C336608BC685DB61EB19E4903EAB7A5F7D9780F808026DB8D93B69DF3CD444CB50
                                                                                                                                                                                                                            Function 00007FF7BC0F9970 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CompatibleCreateObjectSelect$BitmapConcurrency::details::_DeleteSchedulerScheduler::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2453095338-3916222277
                                                                                                                                                                                                                            • Opcode ID: 35cec4d2eec9fa19ddf4e6ff6404fd960e49ea527ef232a0f76cb1028a1e667a
                                                                                                                                                                                                                            • Instruction ID: f87a1e8eeaff40387d766b840138d4753124e300e911dbee1b5bf77cb79238d9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 35cec4d2eec9fa19ddf4e6ff6404fd960e49ea527ef232a0f76cb1028a1e667a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F0419236618B8586D760DB5AE4943AAF7A0F7D9790F408125EB8D83B68DF7CE444CB04
                                                                                                                                                                                                                            Function 00007FF7BC096040 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 394windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SHAppBarMessage.SHELL32 ref: 00007FF7BC096288
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC090551
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsDecorator::getMessageTableTypetype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: product$start_button_not_created$startbutton_skip_win11_autohide_panel$system_panel_not_found
                                                                                                                                                                                                                            • API String ID: 2049050782-76959595
                                                                                                                                                                                                                            • Opcode ID: 3446cfeddc060b1dfdfacc13c981b3b95b19809b138bd91cd57c2eae240aa539
                                                                                                                                                                                                                            • Instruction ID: 0037009a08a228756fd7ae178b00e90d75c08b1afddc67b9c36c6d52fc66c542
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3446cfeddc060b1dfdfacc13c981b3b95b19809b138bd91cd57c2eae240aa539
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9522C93660DAC6A1DA70AB18E8903EAB364FBD6740F809532D78D43B6DEF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC0F5FB0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __crt_scoped_stack_ptrshared_ptr$#200atomictask
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2329723283-0
                                                                                                                                                                                                                            • Opcode ID: eec43635d4d0d912bd5841557c7b9557d51348a900380df349c5f13bb5fc96cd
                                                                                                                                                                                                                            • Instruction ID: 99681cd7a9fc39ac1a2443f52ecce17db8a4b7497382b81afce9f09dc8292953
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eec43635d4d0d912bd5841557c7b9557d51348a900380df349c5f13bb5fc96cd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EE71112261CA8581DA20EB59E8913AFF764FBD6780F808132E78D4776EDF2CD544CB60
                                                                                                                                                                                                                            Function 00007FF7BC237520 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 221COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: List$type_info::_name_internal_method$Char_traits
                                                                                                                                                                                                                            • String ID: Start$ToggleButton
                                                                                                                                                                                                                            • API String ID: 765240024-2452787978
                                                                                                                                                                                                                            • Opcode ID: ca6fa7b475d91400d60cba050e9642a9b1d3026f3ca2ac0db73a849a71bda8d1
                                                                                                                                                                                                                            • Instruction ID: ff53bd5fae7de9bbda9cba6b1b1501af965d6709430e4fbe1ba37b561b59618d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca6fa7b475d91400d60cba050e9642a9b1d3026f3ca2ac0db73a849a71bda8d1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6B1E97260DAC285DA70EB19E4507AAB7A0FBD6744F808136E7CD83BA9DF2CD545CB10
                                                                                                                                                                                                                            Function 00007FF7BC0FBAD0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212registryCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112150: RegCreateKeyW.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7BC0FBC9F), ref: 00007FF7BC11217A
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112150: RegDeleteValueW.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7BC0FBC9F), ref: 00007FF7BC1121AB
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112150: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7BC0FBC9F), ref: 00007FF7BC1121BA
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC112150: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00007FF7BC0FBC9F), ref: 00007FF7BC1121E6
                                                                                                                                                                                                                            • RegOpenKeyExW.ADVAPI32 ref: 00007FF7BC0FBE1E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF7BC0FBAF3
                                                                                                                                                                                                                            • Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run, xrefs: 00007FF7BC0FBB5A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Close$Char_traitsCreateDeleteOpenValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run$Software\Microsoft\Windows\CurrentVersion\Run
                                                                                                                                                                                                                            • API String ID: 1230779726-377293507
                                                                                                                                                                                                                            • Opcode ID: 842b6ab4a243af88830f0b13a677ddf31271e4bca4cf7d2d4e5fce264e46d085
                                                                                                                                                                                                                            • Instruction ID: 1dd8b3bafb27ac78683cd77e38330b4b9ad7e7740ffcde02d0279b501a5524ec
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 842b6ab4a243af88830f0b13a677ddf31271e4bca4cf7d2d4e5fce264e46d085
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C0C1B73260DAC195D6B0AB19E8903EAB3A4FBDA790F808125DBCD43B6DDF2CD154CB50
                                                                                                                                                                                                                            Function 00007FF7BC2C32C8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF7BC2C3D14,?,?,?,?,00007FF7BC2BA79D,?,?,?,?,00007FF7BC2813FC), ref: 00007FF7BC2C3444
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,00007FF7BC2C3D14,?,?,?,?,00007FF7BC2BA79D,?,?,?,?,00007FF7BC2813FC), ref: 00007FF7BC2C3450
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                            • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                            • API String ID: 3013587201-537541572
                                                                                                                                                                                                                            • Opcode ID: b900d435430a5f103d2c1bdfa4f2820a536f3b69551882501559dce37074e2bd
                                                                                                                                                                                                                            • Instruction ID: 8fe191d4b23bc8d912edaa9631b3849e63862decf373f25c1f8df785b8bf2ae4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b900d435430a5f103d2c1bdfa4f2820a536f3b69551882501559dce37074e2bd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E5411621B1DA0281EA26AB1AA8145F6A390BF66B90FC5C539DF1D57788DF3CE4058360
                                                                                                                                                                                                                            Function 00007FF7BC23D580 Relevance: 12.2, APIs: 8, Instructions: 225COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1755220593-0
                                                                                                                                                                                                                            • Opcode ID: b463dd9d402667cf3ef89470c8f21a3e89c6157a2433209e970926fc6277b086
                                                                                                                                                                                                                            • Instruction ID: e000a79c7d891732060558abc4ff913d8f35f01dce94a190f35288b0ee2027f7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b463dd9d402667cf3ef89470c8f21a3e89c6157a2433209e970926fc6277b086
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8B1E92661CBC585DB70DB2AE4903AEA760FBD6B94F408026DF8D47B6ACF2DD444CB50
                                                                                                                                                                                                                            Function 00007FF7BC2B0E80 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: f$p$p
                                                                                                                                                                                                                            • API String ID: 3215553584-1995029353
                                                                                                                                                                                                                            • Opcode ID: 6f4758e8455b3c582431fd9143ecc6f95f7555859754ceda06c37393b6817565
                                                                                                                                                                                                                            • Instruction ID: cb5aafbf33c5753c9999543ade582975fd9d84e0e3c694f1fa8eac0475bc2d6e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6f4758e8455b3c582431fd9143ecc6f95f7555859754ceda06c37393b6817565
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B4129F62E1C14386FB206A18A1543F9E361EB6A750FD8C135F79A46BC8DF7DE5809B20
                                                                                                                                                                                                                            Function 00007FF7BC0EF7D0 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 488COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Func_class
                                                                                                                                                                                                                            • String ID: array$object$object key$object separator$value
                                                                                                                                                                                                                            • API String ID: 1670654298-2448007618
                                                                                                                                                                                                                            • Opcode ID: 17518177fa5bf14c63144c318cc4df87269cf1ac614ca5695af6caf8104aa4b8
                                                                                                                                                                                                                            • Instruction ID: 8e2d51cd31a4dd6377226a970eb9922cacdfcb276efaf7e05a286bdde0e338b0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 17518177fa5bf14c63144c318cc4df87269cf1ac614ca5695af6caf8104aa4b8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C042F66660DAC585D6B0EB19E8902EEB364EBD6784F808136E7CD47B5EDF2CD580CB10
                                                                                                                                                                                                                            Function 00007FF7BC0F0E90 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 488COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Func_class
                                                                                                                                                                                                                            • String ID: array$object$object key$object separator$value
                                                                                                                                                                                                                            • API String ID: 1670654298-2448007618
                                                                                                                                                                                                                            • Opcode ID: 7e87fd77274a521ca8a168015b1351c09e933640632d342c78326851afa799f0
                                                                                                                                                                                                                            • Instruction ID: 96aef0de65bb4c87e0791e8a5f03211ffcd07b3ae018fe0e928afe4d548d0eba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7e87fd77274a521ca8a168015b1351c09e933640632d342c78326851afa799f0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E42066260DBC585D6B0EB19E8902EEB3A4EBD6784F804026E7CD47B5EDF2CD580CB10
                                                                                                                                                                                                                            Function 00007FF7BC13FF90 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC140161
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: /p.gif$ev.pcapp.store$pcdetails$process_add$process_delete
                                                                                                                                                                                                                            • API String ID: 3970144725-3242555254
                                                                                                                                                                                                                            • Opcode ID: ca317ec198a4985207398826d77b0701e66b93e49bafaa2b60a90f1da7620d91
                                                                                                                                                                                                                            • Instruction ID: 2da8e8e58668a0928b3d2fe88fa077bd0784cc5ad1714b1689e4b38e6b4ccd2e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca317ec198a4985207398826d77b0701e66b93e49bafaa2b60a90f1da7620d91
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5A51B332609BC695DA60EB58E8803DAB3A4FBD5780F809136D78D43B6DEF6CD548CB50
                                                                                                                                                                                                                            Function 00007FF7BC2D32D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                            • String ID: CONOUT$
                                                                                                                                                                                                                            • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                            • Opcode ID: eddd2493575fffd36178473db237eee3d09d9d22ae17176b1e1a4d61f485cdc8
                                                                                                                                                                                                                            • Instruction ID: 44677072d1620b71a8c1c0db3f73d64c900732f949790b0cfe343cbd132ee996
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: eddd2493575fffd36178473db237eee3d09d9d22ae17176b1e1a4d61f485cdc8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3D11D631B18B4286E350AB5AEC54769F3A0FB6ABE4F808234DB5D87798CF7CD4008754
                                                                                                                                                                                                                            Function 00007FF7BC287B88 Relevance: 9.2, APIs: 6, Instructions: 206COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiStringWide
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2829165498-0
                                                                                                                                                                                                                            • Opcode ID: b6b862448baebf1a13a4e74f695d7dd3fded44265ae353c1136d9be3a601d1a2
                                                                                                                                                                                                                            • Instruction ID: 8d1c34ae474c3a322be2862520d7a11c0cad59192689086030c77c62452bc95b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b6b862448baebf1a13a4e74f695d7dd3fded44265ae353c1136d9be3a601d1a2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6381B172A0874286EB20AF2995443A9A391FF65BE4F848235FB5D87BD9DF3CD4008720
                                                                                                                                                                                                                            Function 00007FF7BC119C80 Relevance: 9.1, APIs: 6, Instructions: 135COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: d704d9f6d4c914da91bb97a70124eaa907eccd68ffda45f1f6012a0ec4a8a684
                                                                                                                                                                                                                            • Instruction ID: 906d9e26d1704b99f05737b0976e452e6b8189dafbc2ca09ae5bb6590208011c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d704d9f6d4c914da91bb97a70124eaa907eccd68ffda45f1f6012a0ec4a8a684
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1651869172EA4A41EF409B1EF495279E360F7D1744F849032FA9F967EDDE2CE4018320
                                                                                                                                                                                                                            Function 00007FF7BC1271A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 185COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Affinity::operator!=Concurrency::details::Hardware$Concurrency::details::_Min_valueSchedulerScheduler::_shared_ptr
                                                                                                                                                                                                                            • String ID: invalid hash bucket count
                                                                                                                                                                                                                            • API String ID: 122474871-1101463472
                                                                                                                                                                                                                            • Opcode ID: 2c13c2001e75f374a57d2876b0a09dfd13ed2be51a2a1c2dd3d113161dc8a856
                                                                                                                                                                                                                            • Instruction ID: e0f2a248fb7b895e7c51e33d5383c873107f65f902e7c08c8f868bf709e3610f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c13c2001e75f374a57d2876b0a09dfd13ed2be51a2a1c2dd3d113161dc8a856
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9591EB6660DB8581DA60EB19F4902ABB360FBD5794F808032EBCD57BADDF2CD544CB60
                                                                                                                                                                                                                            Function 00007FF7BC12FD90 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC12FF13
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: pcdetails$spots$spots_list_is_empty$wlanspots
                                                                                                                                                                                                                            • API String ID: 3970144725-459635628
                                                                                                                                                                                                                            • Opcode ID: 52ee83058681030af5b5c16d97f1a4213afef4213b17a989133f66fd3282cd54
                                                                                                                                                                                                                            • Instruction ID: b9ddae7b0f11feeeeba3f85cf03eb207bfa81ae58368e0fcfc4ac9552cc4d757
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 52ee83058681030af5b5c16d97f1a4213afef4213b17a989133f66fd3282cd54
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4851C232619BC595DA60EB58F8803DAB3A4FBD6780F809122E78C43B6DDF6CD548CB50
                                                                                                                                                                                                                            Function 00007FF7BC095C60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC095DE3
                                                                                                                                                                                                                            • type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC095E15
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC095E22
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC13CCD0: ShellExecuteW.SHELL32 ref: 00007FF7BC13CD39
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC13CCD0: GetLastError.KERNEL32 ref: 00007FF7BC13CD4F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptrtype_info::_name_internal_method$Char_traitsErrorExecuteLastShell
                                                                                                                                                                                                                            • String ID: ?guid=$https://pcapp.store/account/login
                                                                                                                                                                                                                            • API String ID: 4082085952-2754287439
                                                                                                                                                                                                                            • Opcode ID: 82726d40712215212a96a62fb6fb530ad1512ad774ec9c8fea4602e3821597c5
                                                                                                                                                                                                                            • Instruction ID: 0a15ebea283aa2379924ff8a1bbd37b662667b935b18e806b121d78e55198481
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 82726d40712215212a96a62fb6fb530ad1512ad774ec9c8fea4602e3821597c5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D441EB2261DA8291DA60AB58E8513EBF360FBD6780F808132E78D43B6EDF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC095A50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MessagePost
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 410705778-3916222277
                                                                                                                                                                                                                            • Opcode ID: 7bee137265fb5014d2b543f6e157df9520fbe0187814ba912f6c14cf2ca86a50
                                                                                                                                                                                                                            • Instruction ID: 8f907e284ee47fcf4dcb820d203dd2e7e101da15b9777d510c0370c23e6672fb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7bee137265fb5014d2b543f6e157df9520fbe0187814ba912f6c14cf2ca86a50
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F031733261875686E720DF1AE45533AA3A0FB9A781F904635FA8D87F98CF7CD1008F14
                                                                                                                                                                                                                            Function 00007FF7BC0C40A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF7BC0C40E8
                                                                                                                                                                                                                            • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF7BC0C4106
                                                                                                                                                                                                                            • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF7BC0C4124
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090F30: char_traits.LIBCPMTD ref: 00007FF7BC090F5D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0BBF40: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0BBFC8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3DF0
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3E31
                                                                                                                                                                                                                            • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF7BC0C4144
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Exception$Destroy$Concurrency::details::EmptyFileHeaderQueue::RaiseStructuredWorkchar_traits
                                                                                                                                                                                                                            • String ID: type must be number, but is
                                                                                                                                                                                                                            • API String ID: 1470042880-1272216085
                                                                                                                                                                                                                            • Opcode ID: aa7e7621ec0cb0be2e331e12edbd3784bd4fcc7e2b85b9545d6c7af530bfc852
                                                                                                                                                                                                                            • Instruction ID: 617f6725676edf9c15387162e74c56ad77cc5eafc76737ef59a35233efb3dc10
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: aa7e7621ec0cb0be2e331e12edbd3784bd4fcc7e2b85b9545d6c7af530bfc852
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1031102650DA8186E760EB58E8513BEE760F7E6784F908032EBCD4766DDF2CD545CB20
                                                                                                                                                                                                                            Function 00007FF7BC0EBBC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF7BC0EBC08
                                                                                                                                                                                                                            • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF7BC0EBC26
                                                                                                                                                                                                                            • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF7BC0EBC44
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090F30: char_traits.LIBCPMTD ref: 00007FF7BC090F5D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0BBF40: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0BBFC8
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3DF0
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3E31
                                                                                                                                                                                                                            • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF7BC0EBC65
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Exception$Destroy$Concurrency::details::EmptyFileHeaderQueue::RaiseStructuredWorkchar_traits
                                                                                                                                                                                                                            • String ID: type must be number, but is
                                                                                                                                                                                                                            • API String ID: 1470042880-1272216085
                                                                                                                                                                                                                            • Opcode ID: 8b39ff9f11193aed763a64e79f7bdbc0525becd687c1bcdccf8bf3d52f8b6cf1
                                                                                                                                                                                                                            • Instruction ID: 5cf8d4729fe3b1a17b7f1b7fbc65301bec114e42e2699eed5037208b66bc285a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8b39ff9f11193aed763a64e79f7bdbc0525becd687c1bcdccf8bf3d52f8b6cf1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 23314E3290DA8685E660FB58E8513AEF760FBD6784F808032E78E4766DDF2CD445CB60
                                                                                                                                                                                                                            Function 00007FF7BC0A3A40 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • std::make_error_code.LIBCPMTD ref: 00007FF7BC0A3AF8
                                                                                                                                                                                                                            • std::ios_base::failure::failure.LIBCPMTD ref: 00007FF7BC0A3B0A
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3DF0
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3E31
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFileHeaderRaisestd::ios_base::failure::failurestd::make_error_code
                                                                                                                                                                                                                            • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                                                                            • API String ID: 1846417002-1866435925
                                                                                                                                                                                                                            • Opcode ID: 0f62f35f85c9331fb493dc62c46e977a0797ab21aa6102782599f6169915fda0
                                                                                                                                                                                                                            • Instruction ID: a3f99d239dc84a3173b1be28d6c2b5b95569a32542a07193dea1a513074b644e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0f62f35f85c9331fb493dc62c46e977a0797ab21aa6102782599f6169915fda0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6421FC32A1C68286D760EB18E8413AAB7A0F7A5344F988535E78D83B5DDF2CD544CB20
                                                                                                                                                                                                                            Function 00007FF7BC23F8B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$FromMetricsMonitorPointSystem
                                                                                                                                                                                                                            • String ID: 0
                                                                                                                                                                                                                            • API String ID: 3043705201-4108050209
                                                                                                                                                                                                                            • Opcode ID: b1cef08877c957b104a08cd9897fa60d020e7807a6ff63bc0b0519007cdeadc3
                                                                                                                                                                                                                            • Instruction ID: a081b3e59f6c1f7e37de9d5e5e1b50bc1ca571fcd6003985f73d5814ceb82442
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b1cef08877c957b104a08cd9897fa60d020e7807a6ff63bc0b0519007cdeadc3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 271128766086058BE325DF28E05425BFBB1F799794F508229E78A82B68DF7DC584CF00
                                                                                                                                                                                                                            Function 00007FF7BC0CBBB0 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: fpos
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1083263101-0
                                                                                                                                                                                                                            • Opcode ID: 29a01e6a9a3341e3bae9e12a73ce023ce4ac41a2dd13284b68cb0a05e65b8897
                                                                                                                                                                                                                            • Instruction ID: 24fe4bde8d47399b6992423e51e799f9931217f1420853dccecbc5fc8350f860
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 29a01e6a9a3341e3bae9e12a73ce023ce4ac41a2dd13284b68cb0a05e65b8897
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6A12D2260CBC585DA70AB19E88036BE7A0F796794F548131EBDE87B9DDF2CD484CB10
                                                                                                                                                                                                                            Function 00007FF7BC0B5D70 Relevance: 7.7, APIs: 5, Instructions: 198COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::_CriticalHandleLock::_Ptr_baseReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 831620384-0
                                                                                                                                                                                                                            • Opcode ID: 8acf559ac4f6f1e067d8c9687afc7898d87ed37e1acf036b7df9c07755b38af5
                                                                                                                                                                                                                            • Instruction ID: 4745b091eb4c1b5b30a870059508858867c5f8bdd721dabb11fb07dad2ce000d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8acf559ac4f6f1e067d8c9687afc7898d87ed37e1acf036b7df9c07755b38af5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83A10C3250DA8691D660EB19E8913EBE360FBE6380F809131E7CD47A9EDF6CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC13C0C0 Relevance: 7.6, APIs: 5, Instructions: 102COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_$Decorator::getTableType
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1823342465-0
                                                                                                                                                                                                                            • Opcode ID: ed9f00fc25c8ce21452362e0b07111e9ee6e1f1a89eabee98c2beb6bd0e59022
                                                                                                                                                                                                                            • Instruction ID: 56208a1a2419cd137759f05fd3bf8ebadbc08a3ffbc3eb9da21f47bb3901c3ba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ed9f00fc25c8ce21452362e0b07111e9ee6e1f1a89eabee98c2beb6bd0e59022
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7A51F82260DAC595D660AB19F8503AFF7A4FBD6744F808135E7CD42BAEDF2CD5048B50
                                                                                                                                                                                                                            Function 00007FF7BC08BA40 Relevance: 7.6, APIs: 5, Instructions: 91COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: char_traits$Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valuewmemset
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1140703174-0
                                                                                                                                                                                                                            • Opcode ID: a2a4ec25b6e31abc5ebee565387594cafba7f1d1b495076441b62677608d7f31
                                                                                                                                                                                                                            • Instruction ID: 5b85ffa42c29398d80a900df6ea89e81d6dcb9f98a3281ea83a6d0149a7ad2a4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a2a4ec25b6e31abc5ebee565387594cafba7f1d1b495076441b62677608d7f31
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 37411B2661DB4582CA20EB19E89116EA7A0FBDAB84F505136FB8D43B6DDF3CD540CF50
                                                                                                                                                                                                                            Function 00007FF7BC29CDAC Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                            • Opcode ID: 50c47a8827274f38c0f3736f1fd31936bd58678a38fb0b5f20a044c21de0f8e4
                                                                                                                                                                                                                            • Instruction ID: bcf4e3a43dbffc45a35622b68400f6b4aa59c91bcc06c175221c7f14f4997231
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 50c47a8827274f38c0f3736f1fd31936bd58678a38fb0b5f20a044c21de0f8e4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1631E421A08B4680EB05BB1DD4405F8E760EF66BA0FD88132DB9E477DDDE7CE4828320
                                                                                                                                                                                                                            Function 00007FF7BC29CEC4 Relevance: 7.6, APIs: 5, Instructions: 81COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 459529453-0
                                                                                                                                                                                                                            • Opcode ID: 068b1c0e13995d3bb25b6ae7d09f438031ac356ec0162791c5b29fddeb1f9623
                                                                                                                                                                                                                            • Instruction ID: 9627f7de95db258aa7af517b8127da0b6b57a44194c92194de9086054e82db37
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 068b1c0e13995d3bb25b6ae7d09f438031ac356ec0162791c5b29fddeb1f9623
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1C319221B09A4680EA15BF19D4405F8E760EF66BA0FC88177DB4D477EDDE7CE4458320
                                                                                                                                                                                                                            Function 00007FF7BC0CD500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 147COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::$Affinity::operator!=EmptyHardwareQueue::StructuredWorkshared_ptr
                                                                                                                                                                                                                            • String ID: /
                                                                                                                                                                                                                            • API String ID: 842898399-2043925204
                                                                                                                                                                                                                            • Opcode ID: 236cfa6c4bbf7aac75d00bb3dcb94dfb3fa13d523e07808725eb07bd8f3f7b80
                                                                                                                                                                                                                            • Instruction ID: fcee4b73eb08fec3d9d17b7206759334fe2751031cdff57a8494a8dee611410f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 236cfa6c4bbf7aac75d00bb3dcb94dfb3fa13d523e07808725eb07bd8f3f7b80
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6961F02250DAC255D670A718E8912FFE764FBE6744F809131E3CD86AAEDF2CD545CB10
                                                                                                                                                                                                                            Function 00007FF7BC0BB620 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 140COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0BB8A9
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC090551
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC13CB90: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF7BC13CBB7
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC13CB90: HandleT.LIBCPMTD ref: 00007FF7BC13CBC6
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC13CB90: std::ios_base::good.LIBCPMTD ref: 00007FF7BC13CC02
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC13CB90: std::ios_base::good.LIBCPMTD ref: 00007FF7BC13CC16
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$std::ios_base::good$Char_traitsConcurrency::details::_CriticalDecorator::getHandleLock::_ReentrantScoped_lockScoped_lock::~_TableTypetype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: /p.gif$bhist$ev.pcapp.store
                                                                                                                                                                                                                            • API String ID: 200462385-3993023549
                                                                                                                                                                                                                            • Opcode ID: d0f0d43165f0545ac699685a664fa682f3618fb12f59a37d38a1b99f21a676e3
                                                                                                                                                                                                                            • Instruction ID: c5b44792ca97da5cbb36814a075efa91541597715b69b2fb765ee688665e5788
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d0f0d43165f0545ac699685a664fa682f3618fb12f59a37d38a1b99f21a676e3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9671B436609BC291DAB0AB18E8803DAB3A4FBD9740F808536E7CD43B6DDF68C554CB50
                                                                                                                                                                                                                            Function 00007FF7BC123D50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC123E07
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • SELECT moz_places.url, moz_places.title, moz_places.visit_count, moz_historyvisits.visit_date/1000000 AS visit_time FROM moz_places JOIN moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id AND visit_time/1000000 > %d ORDER BY visit_time DESC, xrefs: 00007FF7BC123D8E
                                                                                                                                                                                                                            • d, xrefs: 00007FF7BC123E8E
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                            • String ID: SELECT moz_places.url, moz_places.title, moz_places.visit_count, moz_historyvisits.visit_date/1000000 AS visit_time FROM moz_places JOIN moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id AND visit_time/1000000 > %d ORDER BY visit_time DESC$d
                                                                                                                                                                                                                            • API String ID: 1865873047-3669390177
                                                                                                                                                                                                                            • Opcode ID: 71176f460d19ddf7e97c69f1ed04067ba8bc97c6df1d3786cd717678e8ca51a4
                                                                                                                                                                                                                            • Instruction ID: f54d6eee394a73804752cd918bd0dfca10f127f61ef32b34cb4fa18a0b3070f3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 71176f460d19ddf7e97c69f1ed04067ba8bc97c6df1d3786cd717678e8ca51a4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F3510A7261CA8681D660EB19E4503EAF364FBE6780F909031E78D87AAEDF2CD404CB50
                                                                                                                                                                                                                            Function 00007FF7BC1338C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::_SchedulerScheduler::_
                                                                                                                                                                                                                            • String ID: notify_widget_click$product${"app": {"init": {"engineInit": true}}}
                                                                                                                                                                                                                            • API String ID: 2780765137-2196947271
                                                                                                                                                                                                                            • Opcode ID: 16edc3c38913eaa69b47f133d6ba9dd3f4d722e52a246288088c7f344e518104
                                                                                                                                                                                                                            • Instruction ID: 77b90e0f42474ef64ef18d422bb36fbf00501638d0580fa3b09c6a9ba5bba3eb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 16edc3c38913eaa69b47f133d6ba9dd3f4d722e52a246288088c7f344e518104
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5841C572619A8591EA60EB18E4803DAF7A4FBD6780F809022E78D43B6DDF7DD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC0AB220 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC281928: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF7BC0AB231), ref: 00007FF7BC28193D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC28190C: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF7BC0AB23B), ref: 00007FF7BC281915
                                                                                                                                                                                                                            • _Subatomic.LIBCONCRTD ref: 00007FF7BC0AB28E
                                                                                                                                                                                                                            • _Subatomic.LIBCONCRTD ref: 00007FF7BC0AB32A
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: PerformanceQuerySubatomic$CounterFrequency
                                                                                                                                                                                                                            • String ID: d
                                                                                                                                                                                                                            • API String ID: 3831891851-2564639436
                                                                                                                                                                                                                            • Opcode ID: cd5766774a5e917e55ed93759baa310a6381a8aa9e51a2e88b1ad031a6da0d5f
                                                                                                                                                                                                                            • Instruction ID: fcf14d59b9858cd7acb77445117b7eb66decdc81fff7a6f5c2feb4b12e9d7c93
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cd5766774a5e917e55ed93759baa310a6381a8aa9e51a2e88b1ad031a6da0d5f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7331E722609B8582DA60EB19F88136BF7A1F7D5784F419126E7CE47B69EF7CD1148B00
                                                                                                                                                                                                                            Function 00007FF7BC129560 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message
                                                                                                                                                                                                                            • String ID: 0$0
                                                                                                                                                                                                                            • API String ID: 2030045667-203156872
                                                                                                                                                                                                                            • Opcode ID: 6caa16854a35b4badb024bad1baed7d586a18f4617ca1ba13612c32c3a01b98f
                                                                                                                                                                                                                            • Instruction ID: 036d81e523a47173349f7ade148001070aad6fa897cf2da5d46532e360024f62
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6caa16854a35b4badb024bad1baed7d586a18f4617ca1ba13612c32c3a01b98f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8E311736209B899ADB60DB19E45039AB7A5F3D87D0F808035EB8D43B68DF7CC648CB00
                                                                                                                                                                                                                            Function 00007FF7BC129410 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$MonitorRect$FromInfoWindow
                                                                                                                                                                                                                            • String ID: 0$0
                                                                                                                                                                                                                            • API String ID: 3203973389-203156872
                                                                                                                                                                                                                            • Opcode ID: bf1010573e3f3a245d3de0730b3cbbcce06f9b06f91d180bbfb8da37b1fbff6b
                                                                                                                                                                                                                            • Instruction ID: 9fa39d531e4ebe2cbbbc6112a5cafc19df27ebbc67ffb490faa155e954d6a88d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bf1010573e3f3a245d3de0730b3cbbcce06f9b06f91d180bbfb8da37b1fbff6b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 60312836619B8986DB60DB19F49039AB7A5F7C9BC0F804026EB8D97B68DF3CC544CB10
                                                                                                                                                                                                                            Function 00007FF7BC111CD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::cancellation_token::_FromImpl
                                                                                                                                                                                                                            • String ID: at line $, column
                                                                                                                                                                                                                            • API String ID: 2278334151-191570568
                                                                                                                                                                                                                            • Opcode ID: dc022c20d47e2cb9e8a1c392fdddab0337882a72ed377b2eedd2c77f924433b8
                                                                                                                                                                                                                            • Instruction ID: 41c9f0a308c78e789408172931308bfafb4fae99b42597fccd05173eb5e3d80b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dc022c20d47e2cb9e8a1c392fdddab0337882a72ed377b2eedd2c77f924433b8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0231D232509B8581DA60EB19E88139AB7A0F7DA780F508126EBCD43B69DF7CD545CB40
                                                                                                                                                                                                                            Function 00007FF7BC1291E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: MonitorRect$FromInfoWindow
                                                                                                                                                                                                                            • String ID: (
                                                                                                                                                                                                                            • API String ID: 2740140340-3887548279
                                                                                                                                                                                                                            • Opcode ID: c0da5ba939e15d805878956d32222060a52adf0d43ead3bad2df4335e0b549e8
                                                                                                                                                                                                                            • Instruction ID: be7b2b1e8f839451255a57dc3b3273a6595de71261ce02f30f7f6783945cae94
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c0da5ba939e15d805878956d32222060a52adf0d43ead3bad2df4335e0b549e8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A4F0EC36608A8596DAA0EB14F84429AA760F7C8794F808531EACE43B2CDF7CC549CB00
                                                                                                                                                                                                                            Function 00007FF7BC2C5FC4 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2718003287-0
                                                                                                                                                                                                                            • Opcode ID: e0a2a62e0f713af7763cde0411d0fa7f4265e5d5c133a46c338ab1ed46e329b8
                                                                                                                                                                                                                            • Instruction ID: fa87aeb7be368b2a98cb921544112c6847a9de1de6512baafd88ef6f9fc86676
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e0a2a62e0f713af7763cde0411d0fa7f4265e5d5c133a46c338ab1ed46e329b8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 11D13432B08A8189E721DF79D5402ED7BB1FB65B98B848236CF5D97B89DE38D406C350
                                                                                                                                                                                                                            Function 00007FF7BC115C20 Relevance: 6.2, APIs: 4, Instructions: 245COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: swap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 630424929-0
                                                                                                                                                                                                                            • Opcode ID: 34ce7f9225db79bbc210459c6b5e2f16bf786037060c5ec49b5396fcd4916ac1
                                                                                                                                                                                                                            • Instruction ID: 3e9a01a89b7632f35a40682c091f3352e96a00ec81108a932a30e8db86826004
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34ce7f9225db79bbc210459c6b5e2f16bf786037060c5ec49b5396fcd4916ac1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D4D1EF6260EAC485EB70EB1AE8507AFA760FBD5B84F508126DB8D47B5ECF2CC444CB54
                                                                                                                                                                                                                            Function 00007FF7BC0B7C00 Relevance: 6.2, APIs: 4, Instructions: 208COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0B7C32
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0B7DF3
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0B7E08
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0AA970: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0AA97E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0AA970: _Max_value.LIBCPMTD ref: 00007FF7BC0AA9A3
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0AA970: _Min_value.LIBCPMTD ref: 00007FF7BC0AA9D1
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0B7F47
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 348937374-0
                                                                                                                                                                                                                            • Opcode ID: a8a6057733bc9d46b4cd21b373c43c5aa681910d6c2af1098b7a63836fd1ffaf
                                                                                                                                                                                                                            • Instruction ID: e29aec2dac4d64415047a3743eb61ce70a19e0b6fa25247cc64c026f15cdf195
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a8a6057733bc9d46b4cd21b373c43c5aa681910d6c2af1098b7a63836fd1ffaf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8CB1FE2660DB8585DA60EB59E8503AEE7A0F7D9BC0F408136EBCD43B6DDF2CD5408B60
                                                                                                                                                                                                                            Function 00007FF7BC0CA090 Relevance: 6.2, APIs: 4, Instructions: 173COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2155007778-0
                                                                                                                                                                                                                            • Opcode ID: 67e42fc80276c32ed0256da7e95af534a81ad04070bc67cdcdcdcbb85b244a4b
                                                                                                                                                                                                                            • Instruction ID: 19770cac5a0bb906ba4d3bfb8837966cb2460f0095372b5a9c8488c811c4666d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 67e42fc80276c32ed0256da7e95af534a81ad04070bc67cdcdcdcbb85b244a4b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3091D632609AC585EA70AA19E8503EBA765F7D9780F808032EBCD43BADDF6CD545CB50
                                                                                                                                                                                                                            Function 00007FF7BC0A5590 Relevance: 6.2, APIs: 4, Instructions: 173COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2155007778-0
                                                                                                                                                                                                                            • Opcode ID: 2c33bb6433a4ec891ff6165309916546a10d19cad6924c5f591d7186bc3493a6
                                                                                                                                                                                                                            • Instruction ID: 5d301422f81f8395e004e5be468fc6900ab52a79bfe9c8f707cd9d854c451a0e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c33bb6433a4ec891ff6165309916546a10d19cad6924c5f591d7186bc3493a6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4391A536609AC585EA70EB15E8503EAA364F7D9780F848032EBCD83BADDF6CD545CB50
                                                                                                                                                                                                                            Function 00007FF7BC0C9B00 Relevance: 6.1, APIs: 4, Instructions: 145COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkfrexplswprintf
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2911421839-0
                                                                                                                                                                                                                            • Opcode ID: edd66fc514574a58961c1f2b6052aadd014439acd1c4e242c25fd11f0a124995
                                                                                                                                                                                                                            • Instruction ID: 4d1c4797a49801d83ab40de8e2be6db34c26023b4bd437086ea56abdeed1632b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: edd66fc514574a58961c1f2b6052aadd014439acd1c4e242c25fd11f0a124995
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A271293250DAC589D661AB29E8503ABFBA0EBD6390F508136E7DD43A9EDF2CD544CF10
                                                                                                                                                                                                                            Function 00007FF7BC0CBF50 Relevance: 6.1, APIs: 4, Instructions: 144COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: fpos
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1083263101-0
                                                                                                                                                                                                                            • Opcode ID: df175f4de71e66e6b5be73ffac7f5b6b237808cdf2cd3de5d06c119983bd8ab6
                                                                                                                                                                                                                            • Instruction ID: 4a4ef063d40c39aad50c31be7fa57e2002d6a914c3e9246f046d2a7b573111cf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: df175f4de71e66e6b5be73ffac7f5b6b237808cdf2cd3de5d06c119983bd8ab6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6661002261CA8186E660AA1DE84136BA7A0F7D6794F544235FBDD87BADCF2CD480CF10
                                                                                                                                                                                                                            Function 00007FF7BC0A9DD0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 136COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00007FF7BC0A9DFD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC090551
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9190
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsDecorator::getErrorLastTableTypetype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: eCode=%lu$product$taskbar_handler_error
                                                                                                                                                                                                                            • API String ID: 2217433456-2493891406
                                                                                                                                                                                                                            • Opcode ID: 795ae17a0a64ec2be7a152d808e0091a20444d18e10fee8e0eceb63c75ad8e85
                                                                                                                                                                                                                            • Instruction ID: d4782cfb5c997a709fc66e2a70434a12f2bca3287ea4064441272260b32f61c9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 795ae17a0a64ec2be7a152d808e0091a20444d18e10fee8e0eceb63c75ad8e85
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B661C93260DAC291DA60AB18E8413EAB364FBD6340F809536E78D43B6DEF6CD559CB50
                                                                                                                                                                                                                            Function 00007FF7BC120080 Relevance: 6.1, APIs: 4, Instructions: 77COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __std_fs_convert_wide_to_narrow$Concurrency::details::EmptyListQueue::StructuredWorkstd::make_error_code
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3856960188-0
                                                                                                                                                                                                                            • Opcode ID: 4157f68cdb56d6d25ae8bc928bb773fbd150dc22e8f81d30abe7ed3d1957b054
                                                                                                                                                                                                                            • Instruction ID: 1d99def3428357bba7a5636e79e7d6aa5bb7604b50e70d68ebcc578d2a7c8a1c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4157f68cdb56d6d25ae8bc928bb773fbd150dc22e8f81d30abe7ed3d1957b054
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC31FA7261968586D660EB19E8817ABF7A0FBD6780F409035F7CD87A6EDF2CE4408B50
                                                                                                                                                                                                                            Function 00007FF7BC119A70 Relevance: 6.1, APIs: 4, Instructions: 76COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __std_fs_convert_narrow_to_wide$Concurrency::details::EmptyListQueue::StructuredWorkstd::make_error_code
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 108412505-0
                                                                                                                                                                                                                            • Opcode ID: 7f0bd93ea57f0a249fb61194e02204684811e5adfb144f6916f60e9b6a7e6cf0
                                                                                                                                                                                                                            • Instruction ID: 7e3c832b72f2e8612e38e3d1e965a6cfdf47c05ef3d026d3eb9c5087c71ba9af
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f0bd93ea57f0a249fb61194e02204684811e5adfb144f6916f60e9b6a7e6cf0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0431F67261968586D660EB19E8817ABF7A0FBD6780F409035F7CD87A6EDF3CE4048B50
                                                                                                                                                                                                                            Function 00007FF7BC08FFC0 Relevance: 6.1, APIs: 4, Instructions: 59COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 228209623-0
                                                                                                                                                                                                                            • Opcode ID: 0e9d9b7ec70ef19548af9f3636149500ec62eb1843db83eeb5a441dd1222dba0
                                                                                                                                                                                                                            • Instruction ID: aed2638cd378b366460b77fc3eda60523101d289ef812dcf77b2ca25c9bee32a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0e9d9b7ec70ef19548af9f3636149500ec62eb1843db83eeb5a441dd1222dba0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D721FE2651DA4581DA50AB1DE88026AF7A0FBD57A4F909232F78E43BADDF7CD540CB10
                                                                                                                                                                                                                            Function 00007FF7BC0900D0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 228209623-0
                                                                                                                                                                                                                            • Opcode ID: a1cf8dc90f5bdb72dce43e9b990161097aacd9b0e3afd82c52d20cf5252aa774
                                                                                                                                                                                                                            • Instruction ID: c90199675fd931e380f7b9339eea3f3f4948393d04fb3bebb613cec475cc60d2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a1cf8dc90f5bdb72dce43e9b990161097aacd9b0e3afd82c52d20cf5252aa774
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9D213E2651CA4581DA50AB19E8802AAF7B0FBD67A4F909231F78E43BADCF7CD540CB50
                                                                                                                                                                                                                            Function 00007FF7BC0F3170 Relevance: 6.1, APIs: 4, Instructions: 59COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 228209623-0
                                                                                                                                                                                                                            • Opcode ID: 0e975e66747d57a99f60245d8ecff6f2dc4d5811a49aac47bfed1128c8f91008
                                                                                                                                                                                                                            • Instruction ID: bd7256170c88976c129b6e8ca4082680a6e0f487f0982e09e43dd1ef835c313e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0e975e66747d57a99f60245d8ecff6f2dc4d5811a49aac47bfed1128c8f91008
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7214F3251CA4581DA50EB19E8802AAF7A4FBD67A4F905231F79E43BADCF3CD544CB10
                                                                                                                                                                                                                            Function 00007FF7BC0F2F50 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 228209623-0
                                                                                                                                                                                                                            • Opcode ID: ee95b762b0cf94fc72d457ec374968ca4aff422890421fcd6926c44d14f9877b
                                                                                                                                                                                                                            • Instruction ID: f6ed3624ecc32d2cb9883e65b9269e809858acb136297b2bd6a76762050db08c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ee95b762b0cf94fc72d457ec374968ca4aff422890421fcd6926c44d14f9877b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4821F12251DA8581DA50EB19E4902AAF764FBD57A4F905232F78E43BBDDF3CD540CB10
                                                                                                                                                                                                                            Function 00007FF7BC0FADC0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ConditionMask$InfoVerifyVersion
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2793162063-0
                                                                                                                                                                                                                            • Opcode ID: ca6a0869207d72d33c9b7a660a3a7bea133d9399d10461ba54ec6bb84780c07d
                                                                                                                                                                                                                            • Instruction ID: f517ffca6174d4822bce6a3614f15a9855a3c206c6cc0671e1fbe63626af582a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ca6a0869207d72d33c9b7a660a3a7bea133d9399d10461ba54ec6bb84780c07d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2421683662C28186E360CF24E4483ABB7A0FB99750F405039E7898BBA8EB7DC544CF54
                                                                                                                                                                                                                            Function 00007FF7BC2874EC Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 203985260-0
                                                                                                                                                                                                                            • Opcode ID: bee03ca3288017b3369f8dcb09f862a3064febdc74deef89483fb6043f1d9de6
                                                                                                                                                                                                                            • Instruction ID: 14a2918b5f4fa641b5277572a2a570401952490ffaa1eba1a14be3655daded06
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bee03ca3288017b3369f8dcb09f862a3064febdc74deef89483fb6043f1d9de6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 89219376A18B8687E3109F15E44835EBBB4FB99F94F548139EB8997B58CF3CD4018B10
                                                                                                                                                                                                                            Function 00007FF7BC0A1B60 Relevance: 6.0, APIs: 4, Instructions: 42COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Func_class
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1670654298-0
                                                                                                                                                                                                                            • Opcode ID: bd01bd58726bd3f0c66db9246e0ea83f485c70cc4ec0d51cd3e4b8a36031a15c
                                                                                                                                                                                                                            • Instruction ID: 114ff28aaecc768fdaeb6aa60fffcde2be0ddbee8793403a98db0b083be06594
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bd01bd58726bd3f0c66db9246e0ea83f485c70cc4ec0d51cd3e4b8a36031a15c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3B11EF2660CA4590DA50B71AEC4116AE7A1FBDABC0F548031FB8D8776EDF2CD5518B20
                                                                                                                                                                                                                            Function 00007FF7BC2A3594 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2933794660-0
                                                                                                                                                                                                                            • Opcode ID: c71fb8e88b71c372db582b079ead3d4d3277890d777de073fadcf7bcbc0d32b8
                                                                                                                                                                                                                            • Instruction ID: f5d65a1283d13a31925556de6d5a13a5aa6230b2b412cc6136cdd12c18736c4b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c71fb8e88b71c372db582b079ead3d4d3277890d777de073fadcf7bcbc0d32b8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1F115E26B14F068AEB00DF64E8542B873A4FB2A758F840E35EB2D477A8DF78D1548350
                                                                                                                                                                                                                            Function 00007FF7BC0C1850 Relevance: 6.0, APIs: 4, Instructions: 33windowCOMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Message$BeginConcurrency::details::_DispatchInitInitializeOncePeekSchedulerScheduler::_Translate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1659482951-0
                                                                                                                                                                                                                            • Opcode ID: 46343ae8780c4d654fa3ec0113a3b23bbcc3f883197a57aab6ad381d8c83bebf
                                                                                                                                                                                                                            • Instruction ID: 3a210b68105ef59e9c190d48bfa05268148b9f13f35bde658b26f0782d5093dc
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 46343ae8780c4d654fa3ec0113a3b23bbcc3f883197a57aab6ad381d8c83bebf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2D010426618A4281EB50EB29E89176EB770FB96780F909035E78E43B69DF2CD4458B10
                                                                                                                                                                                                                            Function 00007FF7BC14BCF0 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC14BD1B
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC14BD2A
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC14BD4B
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC14BD55
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1865873047-0
                                                                                                                                                                                                                            • Opcode ID: 3233295b20d291cbbdb429da83de8f43e4d43eb9944099a1be368375c9ef5e0b
                                                                                                                                                                                                                            • Instruction ID: 15c605b4c996be85b09a9426abf041f17c4a191979f295b9571e746f7e4a5bd0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3233295b20d291cbbdb429da83de8f43e4d43eb9944099a1be368375c9ef5e0b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A901DBA251CA8581DA10FB99E89116FE360FBD57D4F408472FB8D87B6EDFACD4008B50
                                                                                                                                                                                                                            Function 00007FF7BC0C5980 Relevance: 6.0, APIs: 4, Instructions: 30COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0C59AB
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0C59BA
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0C59D3
                                                                                                                                                                                                                            • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0C59DD
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1865873047-0
                                                                                                                                                                                                                            • Opcode ID: 0162076176430ab22fa6d18088bb7c5fa26ba75fb539a11a53f633b1ca86fbc0
                                                                                                                                                                                                                            • Instruction ID: a0ed97bbf460007499e5103072642b189208df9331013581266de689e4a09a1c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0162076176430ab22fa6d18088bb7c5fa26ba75fb539a11a53f633b1ca86fbc0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A101956291C94181DA10BB19E89106BA770FBD6780F508532EB8D87B6ECF2DD8508B50
                                                                                                                                                                                                                            Function 00007FF7BC0C76A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 350COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Mpunctstd::ios_base::width
                                                                                                                                                                                                                            • String ID: @
                                                                                                                                                                                                                            • API String ID: 1954291571-2766056989
                                                                                                                                                                                                                            • Opcode ID: dd89c21f3644dc9b8166415bda9e88d37b4f3a0384955dc7af636263327da036
                                                                                                                                                                                                                            • Instruction ID: 833958b1c3c88c1666516b3975855e0e85f6e0c65696940256fafc7cb3073e8e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dd89c21f3644dc9b8166415bda9e88d37b4f3a0384955dc7af636263327da036
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FE02143260DAC584DA70AA19E8943ABA761F7D9780F848132DBCD83BADDF7CD545CB40
                                                                                                                                                                                                                            Function 00007FF7BC10D8D0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 314COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CreateInstance
                                                                                                                                                                                                                            • String ID: Shell_TrayWnd
                                                                                                                                                                                                                            • API String ID: 542301482-2988720461
                                                                                                                                                                                                                            • Opcode ID: 6908935a9eff792f6ddb4533ba37bf9979519dd0cf2f6cf6eed8dab0889e9ea2
                                                                                                                                                                                                                            • Instruction ID: 21ecd5fca40d5c6751523e5c1773ceb2ba21d7053c8dcdb480f342e7b30243f8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6908935a9eff792f6ddb4533ba37bf9979519dd0cf2f6cf6eed8dab0889e9ea2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D8E1CD3260DAC591D660EB19E8903EAB364FBD5750F808136E78D83BAEDF2CD545CB50
                                                                                                                                                                                                                            Function 00007FF7BC0871B0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7BC0876B9
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                                                            • String ID: $@
                                                                                                                                                                                                                            • API String ID: 3399187363-1077428164
                                                                                                                                                                                                                            • Opcode ID: e94a429781929b5a2c141d3a6beea5541e01ac0ebdc4914e82745f8a6aad066c
                                                                                                                                                                                                                            • Instruction ID: ebfc7d85a5cf8be4fee45076c55e31fc5c0d4828f4437e04078034dd13cfb843
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e94a429781929b5a2c141d3a6beea5541e01ac0ebdc4914e82745f8a6aad066c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FBD1C232249BC695DA70AB08F8903DAB3A4F7D9380F809126DB8C43B6DEF79C555CB50
                                                                                                                                                                                                                            Function 00007FF7BC083D00 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7BC084179
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                                                            • String ID: $@
                                                                                                                                                                                                                            • API String ID: 3399187363-1077428164
                                                                                                                                                                                                                            • Opcode ID: 287c908db94faab9909240b80aa3dab626c1d74600033fe415f1dc5f8f23e253
                                                                                                                                                                                                                            • Instruction ID: 090f1bcff02b7d94a98300bc3f07aec819a3c6d3660160b1f10058641c9a8c9d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 287c908db94faab9909240b80aa3dab626c1d74600033fe415f1dc5f8f23e253
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BDC1C272609AC694DA70AB18E8903EAB364FBD9340F809126DB8D43B6DDF7CC559CB50
                                                                                                                                                                                                                            Function 00007FF7BC0877A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7BC087C19
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                                                            • String ID: $@
                                                                                                                                                                                                                            • API String ID: 3399187363-1077428164
                                                                                                                                                                                                                            • Opcode ID: fa7f3019d1662852162415dffcfbac078c8b71950ff90959c28be1f4afc55cd1
                                                                                                                                                                                                                            • Instruction ID: b4e421b2b2d49eefb791c5ac01708fec03789b80550d778dd6fa6629e1f88c28
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa7f3019d1662852162415dffcfbac078c8b71950ff90959c28be1f4afc55cd1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EBC1C232619AC694DA70AB18E8903EBB364FBD9340F809126DB8D43B6DDF7CC559CB50
                                                                                                                                                                                                                            Function 00007FF7BC085300 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF7BC085779
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                                                            • String ID: $@
                                                                                                                                                                                                                            • API String ID: 3399187363-1077428164
                                                                                                                                                                                                                            • Opcode ID: e487e4444c6866edc1281ddb71addcea3ca4a8cb272eef4d12e88b731a7df87b
                                                                                                                                                                                                                            • Instruction ID: 5c73e7cc2309e9db5a38355048120df9440bc646519332fece6268b09931047a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e487e4444c6866edc1281ddb71addcea3ca4a8cb272eef4d12e88b731a7df87b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4FC1C232609AC694DA70AB18E8903EAB364FBD9340F809126DB8D43B6DDF7CC559CB50
                                                                                                                                                                                                                            Function 00007FF7BC0EF845 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::cancellation_token::_FromImpl
                                                                                                                                                                                                                            • String ID: object key$object separator
                                                                                                                                                                                                                            • API String ID: 2278334151-2279923633
                                                                                                                                                                                                                            • Opcode ID: 6d454f74ac45d6ccd4501eb20f0ac82e94d3955d60955d5f3c4cb3b5a886e362
                                                                                                                                                                                                                            • Instruction ID: 4a0b7ca000b29cad1a2af45eb9fa887575ef04a071164912001535ead3f2abdd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6d454f74ac45d6ccd4501eb20f0ac82e94d3955d60955d5f3c4cb3b5a886e362
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 58B1F66650DAC680E670EB19E8503EEB364EBD6784F908132D7CD87B9EDF2CD5848B50
                                                                                                                                                                                                                            Function 00007FF7BC0F0F05 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::cancellation_token::_FromImpl
                                                                                                                                                                                                                            • String ID: object key$object separator
                                                                                                                                                                                                                            • API String ID: 2278334151-2279923633
                                                                                                                                                                                                                            • Opcode ID: f46b7e787fcbf46f295cec9262e28ba246f18b7607bfbb222b1eb3d36f79fe4c
                                                                                                                                                                                                                            • Instruction ID: 360ea9ffe91599f5e8e4ca89d2c219c9bccdc7ae81cd2b884584b095c420c690
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f46b7e787fcbf46f295cec9262e28ba246f18b7607bfbb222b1eb3d36f79fe4c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3DB1F76250DAC680E670EB19E8903EEB364EBD6784F908132E7CD57B9EDF2CD5448B50
                                                                                                                                                                                                                            Function 00007FF7BC242020 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F05
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D8E90: shared_ptr.LIBCMTD ref: 00007FF7BC0D8F8E
                                                                                                                                                                                                                            • std::bad_exception::bad_exception.LIBCMTD ref: 00007FF7BC242288
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3DF0
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC2A3DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3E31
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsExceptionFileHeaderRaisestd::bad_exception::bad_exceptiontype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: Memory allocation error
                                                                                                                                                                                                                            • API String ID: 3813484266-4275684249
                                                                                                                                                                                                                            • Opcode ID: 920f7d3f8d5bc83466a33a88262faee2d6c9b593748b999b631c745e13f0c05b
                                                                                                                                                                                                                            • Instruction ID: 79194b6f3f640896d54e7011cace577eca93bc70ebe663a27dc18c4d37c92ecd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 920f7d3f8d5bc83466a33a88262faee2d6c9b593748b999b631c745e13f0c05b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F0610A3660AAC595DAA0EB19E4803EAB3A0FBD5780F808032DB8D47B6DDF3CD445CB50
                                                                                                                                                                                                                            Function 00007FF7BC2C7CF8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: ?
                                                                                                                                                                                                                            • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                            • Opcode ID: 6cbf826057bebce549b3c94c9af962d0dc4d0c785dde2893765fa574eae3e6f7
                                                                                                                                                                                                                            • Instruction ID: 9a58a4cfe570af4d1b9f732b79ff25768bc5565df9b4d5326a078137d83e4037
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6cbf826057bebce549b3c94c9af962d0dc4d0c785dde2893765fa574eae3e6f7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5341B312E1868246EB64AB2994013BB97A0EFA2FA4F948235EF5C06BDDDF3CD4418710
                                                                                                                                                                                                                            Function 00007FF7BC0B0070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC23F8B0: SHAppBarMessage.SHELL32 ref: 00007FF7BC23F8FD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC23F8B0: GetSystemMetrics.USER32 ref: 00007FF7BC23F915
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC23F8B0: SHAppBarMessage.SHELL32 ref: 00007FF7BC23F939
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC23F8B0: SHAppBarMessage.SHELL32 ref: 00007FF7BC23F959
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0910B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0910CD
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC0B01D2
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC090510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF7BC090551
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyMessageQueue::StructuredWork$Char_traitsConcurrency::details::_Decorator::getMetricsSchedulerScheduler::_SystemTableTypeshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: Topbar${"app" : {"show_window":"topbar"}}
                                                                                                                                                                                                                            • API String ID: 10853918-1514018050
                                                                                                                                                                                                                            • Opcode ID: 577172dd8fc672824d26078347e03469dd2708803f372b85aadc70d01d9e3a4c
                                                                                                                                                                                                                            • Instruction ID: b532f54090fa2d414b48ef686da9784766cf83d15bfb72958893c23ead491a50
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 577172dd8fc672824d26078347e03469dd2708803f372b85aadc70d01d9e3a4c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CA41D432609BC591DA60AB19E8903DBB3A4FBD5780F809136EB8D43B6EDF2CD544CB50
                                                                                                                                                                                                                            Function 00007FF7BC139BC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0911A0: _WChar_traits.LIBCPMTD ref: 00007FF7BC0911CD
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF7BC0D9930
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D995D
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: shared_ptr.LIBCMTD ref: 00007FF7BC0D9993
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0D98A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF7BC0D9A2E
                                                                                                                                                                                                                            • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF7BC139C6E
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: printer_paper$printer_toner
                                                                                                                                                                                                                            • API String ID: 3970144725-2138351318
                                                                                                                                                                                                                            • Opcode ID: 2c875828d1875243b46563701ab8c5622ab5e21d1a831a18b9cf26e78b6280cb
                                                                                                                                                                                                                            • Instruction ID: 9ede983d1193ab2cb2b80226d51dd20c35c88893826caea05b04d8a213b6b967
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c875828d1875243b46563701ab8c5622ab5e21d1a831a18b9cf26e78b6280cb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0931D332619A85A2DA50EB58E88039BF764FBD6780F809022E78D43A6DDF7CD545CB50
                                                                                                                                                                                                                            Function 00007FF7BC0E722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Concurrency::details::$Affinity::operator!=Hardwareshared_ptr$EmptyQueue::StructuredWorktype_info::_name_internal_method
                                                                                                                                                                                                                            • String ID: 0123456789ABCDEFabcdef-+Xx
                                                                                                                                                                                                                            • API String ID: 947352594-2799312399
                                                                                                                                                                                                                            • Opcode ID: 9206f079de26dfaf4d29c21f41c140430604b0fe994b2d3f15df50169aa253dc
                                                                                                                                                                                                                            • Instruction ID: d767e3d8fee0dff6c7eadd3613f43863d686c8de3105cc02586b43abfc57d9f8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9206f079de26dfaf4d29c21f41c140430604b0fe994b2d3f15df50169aa253dc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9A21262250DAC684D6519A1DE8801BEAB64E7D6780F944032EB8D8776DDF2CD041CB50
                                                                                                                                                                                                                            Function 00007FF7BC2A3DA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3DF0
                                                                                                                                                                                                                            • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7BC0A227F), ref: 00007FF7BC2A3E31
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                            • String ID: csm
                                                                                                                                                                                                                            • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                            • Opcode ID: 292631c76c28477b0b341e5100f2c649277cad9beabe8196f62ee79e546b0a13
                                                                                                                                                                                                                            • Instruction ID: 767e8eaad169cfa92aad6a980c8a01fbf9936b9fa3eafc2f074e95d969aa7219
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 292631c76c28477b0b341e5100f2c649277cad9beabe8196f62ee79e546b0a13
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 68118F36618B8582EB219F19F4002A9B7E0FB99B94F988230EF8C07B58DF3CC551CB00
                                                                                                                                                                                                                            Function 00007FF7BC10F300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC1120D0: shared_ptr.LIBCMTD ref: 00007FF7BC1120DE
                                                                                                                                                                                                                            • #200.OLEAUT32(?,?,?,?,?,?,00007FF7BC0F6250), ref: 00007FF7BC10F372
                                                                                                                                                                                                                              • Part of subcall function 00007FF7BC0F2B90: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FF7BC0F2BCA
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 0000000A.00000002.3038993722.00007FF7BC081000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF7BC080000, based on PE: true
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3037161997.00007FF7BC080000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3056197295.00007FF7BC2EB000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3059536503.00007FF7BC332000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3061689703.00007FF7BC333000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3063889873.00007FF7BC348000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3065758004.00007FF7BC34A000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC34F000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3067567358.00007FF7BC359000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 0000000A.00000002.3071236763.00007FF7BC35C000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_10_2_7ff7bc080000_PcAppStore.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: #200__crt_scoped_stack_ptrshared_ptr
                                                                                                                                                                                                                            • String ID: RoOriginateLanguageException$combase.dll
                                                                                                                                                                                                                            • API String ID: 1462037635-3996158991
                                                                                                                                                                                                                            • Opcode ID: 23039f19f1820bb7f7476837f36a12bc1ccd444b90eeaabbed9ce580c32f9450
                                                                                                                                                                                                                            • Instruction ID: 2dba814816a5a1fdd5ed72734b05d3e0c527ee136cce7e2afc5e4cfabb8583a7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 23039f19f1820bb7f7476837f36a12bc1ccd444b90eeaabbed9ce580c32f9450
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 43012962A18A4691DB10FB28E8910AEE765FFA6344FC08536E78D4367DDF3CD245CB50